A root kit was used to capture detailed accounts receivable information. To ensure admissibility of evidence
from a legal standpoint, once the incident was identified and the server isolated, the next step should be to:
A.
document how the attack occurred.
B.
notify law enforcement.
C.
take an image copy of the media.
D.
close the accounts receivable system.