15. You suspect a user's workstation is infected with malware and are about to begin an investigation. If you want to reduce the likelihood that this workstation will infect other systems on your network, but you still want to preserve as much evidence as possible, which of the following should you do?
(A) Shut down the workstation
(B) Remove the power cord from the workstation
(C) Remove the network cable from the workstation
(D) Remove all USB devices and peripherals