The correct answer is Creating a bit-by-bit image of the device's storage media because it ensures an exact copy of the data is made without altering the original evidence. Modifying metadata can compromise the legal admissibility of the evidence. Using chain of custody forms is important for documenting the evidence handling process, but it is not the first method used to acquire data. Reviewing file access logs is a part of the analysis process which comes after data acquisition.