The forensic principle is to preserve evidence in its original state. Imaging-including capturing residual and deleted data-ensures that the full contents of a storage device are preserved for analysis while maintaining the chain of custody. Hardening (A) may alter system state. Encoding logs (C) is not preservation but transformation. Documenting APIs (D) helps investigation scope but does not preserve evidence. ISACA guidance on digital forensics stresses the importance of bit-level imaging and ensuring evidence integrity through hashing and proper custody documentation.
References (ISACA): ISACA Incident Response & Forensics Guidance; ISACA Journal - Forensic Readiness.