Which describes the best method for preserving the chain of evidence?

Which describes the best method for preserving the chain of evidence?

A.
Shut down the machine that is infected, remove the hard drive, and contact the local authorities.

B.
Back up the hard drive, use antivirus software to clean the infected machine, and contact the local
authorities.

C.
Identify the infected machine, disconnect from the network, and contact the local authorities.

D.
Allow user(s) to perform any business-critical tasks while waiting for local authorities.