After a recent incident, a forensic analyst was given several hard drives to analyze. Which the following should the analyst do FIRST?
A. Take screenshots and capture drive images
B. Take hashes and screenshots
C. Take hashes and capture drive images
D. Perform antivirus scans and create chain of custody documents