Option D is the best answer because the investigator needs a method that allows safe access to a Linux image on a Windows forensic workstation without risking further damage to the evidence. In CHFI methodology, the preferred approach is to use specialized forensic tools that can mount, parse, and inspect images in a read-only, forensically sound manner. That preserves the original evidence and supports controlled analysis.
Converting the image format could alter or complicate the evidence. A Linux emulator is not the most reliable forensic answer for viewing evidence safely on Windows. Using a live boot disk is more appropriate for examining a live system or booting a machine, not for safely inspecting an already acquired image from within a forensic workstation workflow.
Because the problem is specifically about safe evidence handling, cross-platform access, and avoiding further damage, the most effective CHFI-aligned approach is to use a specialized forensic tool designed to view Linux images on Windows . This allows structured analysis, file-system interpretation, and artifact review while preserving evidence integrity.