A security incident requires collection of evidence from a laptop. Which practice best supports later evidence integrity?

1. Rename the evidence file to include the word authentic
2. Allow every investigator to edit the original evidence for convenience
3. Record custody, acquisition methods, and integrity verification throughout handling
4. Retain only a verbal summary without acquisition records