which of the following should be done at the beginning?

After a security incident involving a physical asset, which of the following should be done at
the beginning?

A.
Record every person who was in possession of assets, continuing post-incident.

B.
Create working images of data in the following order: hard drive then RAM.

C.
Back up storage devices so work can be performed on the devices immediately.

D.
Write a report detailing the incident and mitigation suggestions.