During the hard drive forensics analysis, which of the following procedure is followed?

Question options:

First step is to copy the hard drive and recalculate the integrity check $$ it must match

Last, calculate an integrity check on the hard drive: a very large integer $(48$ digits or more$)$

After the evidence collection, the recalculated integrity check must match

Use the native OS of the hard drive to analyze its contents if a computer