During an investigation, an incident responder intends to recover multiple pieces of digital media. Before removing the media, the responder should initiate:
A. malware scans.
B. secure communications.
C. chain of custody forms.
D. decryption tools.