The correct answer is 'Creating a forensic image of affected systems'. This is the right answer because creating a forensic image is a standard procedure in investigations to preserve the state of the system as it was during the incident. Such a forensic image captures all the data on the system, allowing for in-depth analysis without disturbing the original evidence. Other methods such as rebooting systems or copying logs to a USB drive might be useful in specific contexts, but they do not offer a complete and accurate snapshot of the system, which can be crucial for forensic analysis. These actions might also potentially overwrite or modify existing evidence.