Following a malicious security incident, an organization has decided to prosecute those responsible.
Which of the following will BEST facilitate the forensic investigation?
A . Identifying the affected environment
B . Performing a backup of affected systems
C . Determining the degree of loss
D . Maintaining chain of custody
Answer: D