Which of the following is the FIRST step in a forensics investigation when a breach of a client’s
workstation has been confirmed?
A.
Transport the workstation to a secure facility
B.
Analyze the contents of the hard drive
C.
Restore any deleted files and / or folders
D.
Make a bit-for-bit copy of the system