During an incident response, what is the primary reason for placing a system into read-only mode?
To allow for faster data acquisition.
To enhance the performance of forensic tools.
To ensure the system can still log new events.
To prevent any modifications to the data.