Which describes the best method for preserving the chain of evidence?

Which describes the best method for preserving the chain of evidence?
A . Shut down the machine that is infected, remove the hard drive, and contact the local authorities.
B . Back up the hard drive, use antivirus software to clean the infected machine, and contact the local authorities.
C . Identify the infected machine, disconnect from the network, and contact the local authorities.
D . Allow user(s) to perform any business-critical tasks while waiting for local authorities.

View Answer

Answer: C