During a post-incident review. the sequence and correlation of actions must be analyzed PRIMARLY based on:

A. interviews with personnel
B. a consolidated event time line
C. logs from systems involved
D. documents created during the incident