Which of the following should Jane, a security administrator, perform before a hard drive is analyze

Which of the following should Jane, a security administrator, perform before a hard drive is
analyzed with forensics tools?

A.
Identify user habits

B.
Disconnect system from network

C.
Capture system image

D.
Interview witnesses