What is the first step to start an investigation into this leak?

A disgruntled employee has left your company and deleted all their email messages and files in Google Drive. The security team is aware that some intellectual property may have surfaced on a public social media site.

What is the first step to start an investigation into this leak?
A . Delete the user’s account in the Admin Console.
B . Transfer data between end user Workspace accounts.
C . Instruct a Google Vault admin to create a matter, and place all the user data on ‘hold.’
D . Use Google Vault to export all the user data and share among the security team.

Answer: C