An incident responder must collect a disk image for possible legal proceedings. What practice best supports evidence integrity?

1. Use the original disk for normal business work during analysis
2. Email a screenshot without recording its origin
3. Let every investigator change the original files
4. Record custody transfers and verify cryptographic hashes