During a recent security incident investigation, a security analyst mistakenly turned off the

infected machine prior to consulting with a forensic analyst. Upon rebooting the machine, a

malicious script that was running as a background process was no longer present. As a result,

potentially useful evidence was lost. Which of the following should the security analyst have

followed?

A$.$ Order of volatility

B$.$ Chain of custody

C$.$ Verification

D$.$ Secure storage