Which of the following are part of Incident Handling & Response Step $6$: Evidence Gathering and Forensic Analysis?

Question $17$ options:

Create a Chain of Custody Document, Eliminate the Cause of the Incident, and Recover Data From Backup

Create a Chain of Custody Document, Implement Incident Handling & Response Plan, and Define Incident Handling Criteria

Create a Chain of Custody Document, Analyze Evidence, and Hire Third Party Investigators

Create a Chain of Custody Document, Notify the Management, and Contact External Agencies