The security operations team is conducting a mock forensic investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation?
A. Activate the escalation checklist
B. Implement the incident response plan
C. Analyze the forensic image
D. Perform evidence acquisition