Which of the following is the FIRST step the analyst should take?

During an investigation, a computer is being seized. Which of the following is the FIRST step the analyst should take?
A. Power off the computer and remove it from the network.
B. Unplug the network cable and take screenshots of the desktop.
C. Perform a physical hard disk image.
D. Initiate chain-of-custody documentation.

CS0-002: CompTIA CySA+ Exam FULL Printable PDF and Software. VALID exam to help you PASS.