A forensic examiner is dealing with email forensics. Which action is most appropriate?

A. Document the process and preserve evidence integrity. B. Modify original evidence to make analysis easier. C. Ignore chain of custody because the case is technical. D. Delete unrelated files from the original device.