A forensic investigator started the process of gathering evidence on a laptop in response to an incident. The investigator took a snapshot of the hard drive, copied relevant log files, and then performed a memory dump. Which of the following steps in the process should have occurred FIRST?

A$.$ Preserve secure storage.

B$.$ Clone the disk.

C$.$ Collect the most volatile data.

D$.$ Copy the relevant log files.