The FIRST course of action an investigator should take when a computer is being attacked is to:

A. terminate all active processes.
B. copy the contents of the hard drive.
C. disconnect it from the network.
D. disconnect the power source.