Which of the following is the FIRST step in a forensics investigation when a breach of a client’s workstation has
been confirmed?

A.
Transport the workstation to a secure facility

B.
Analyze the contents of the hard drive

C.
Restore any deleted files and / or folders

D.
Make a bit-for-bit copy of the system