A forensic investigator is examining a data breach at a corporate organization involving unauthorized access...

The correct answer is D because every action in the scenario centers on the core forensic objective of collecting and preserving digital evidence in a way that remains reliable, reviewable, and legally defensible. CHFI v11 covers understanding computer forensics, evidence preservation, chain of custody, data acquisition, and reporting, all of which support this primary goal. External references on forensically sound practice describe it as acquiring evidence while minimizing alteration, preserving integrity, documenting changes, and maintaining a process that can stand up in court. The other options describe possible outcomes or broader benefits of an investigation, but they are not the direct objective illustrated by the examiner’s actions. The scenario does not focus mainly on estimating impact, preventing future incidents, or identifying perpetrators. Instead, it emphasizes proper evidence handling from acquisition through legal preparation. In CHFI-style reasoning, when the question highlights careful identification, non-destructive collection, integrity protection, and documentation for litigation, the fundamental objective being applied is to gather evidence of cyber crimes in a forensically sound manner.