The security operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised w...