During a post-incident review, the sequence and correlation of actions must be analyzed PRIMARILY based on:

A. documents created during the incident

B. logs from systems involved

C. a consolidated event time line

D. interviews with personnel