Which of the following is NOT a best practice when prohibited activity is suspected?

Which of the following is NOT a best practice when prohibited activity is suspected?

A.
Back up the hard drive

B.
Turn off the computer

C.
Document the incident

D.
Identify the content