Which of the following is the FIRST step in a forensics investigation when a breach of a client’s workstation has been confirmed?
A. Transport the workstation to a secure facility
B. Analyze the contents of the hard drive
C. Restore any deleted files and / or folders
D. Make a bit-for-bit copy of the system