Which of the following is MOST important when carrying out a forensic examination of a laptop to determine an employee's involvement in a fraud?

A. The employee's network access should be suspended.
B. The laptop should not be removed from the company premises.
C. An HR representative should be present during the laptop examination.
D. The investigation should be conducted on an image of the original disk drive.