A root kit was used to capture detailed accounts receivable information. To ensure admissibility of evidence from a legal standpoint, once the incident was identified and the server isolated, the next step should be to:

A.
document how the attack occurred.

B.
notify law enforcement.

C.
take an image copy of the media.

D.
close the accounts receivable system.

Explanation:
Taking an image copy of the media is a recommended practice to ensure legal admissibility. All of the other choices are subsequent and may be supplementary.