During an incident response, what is the primary reason for placing a system into read-only mode?
To allow for faster data acquisition.
To ensure the system can still log new events.
To prevent any modifications to the data.
To enhance the performance of forensic tools.