The helpdesk reports increased calls from clients reporting spikes in malware infections on
their systems. Which of the following phases of incident response is MOST appropriate as a
FIRST response?