Following a malicious security incident, an organization has decided to prosecute those responsible. Which of the following will BEST facilitate the forensic investigation?

A. Identifying the affected environment
B. Performing a backup of affected systems
C. Determining the degree of loss
D. Maintaining chain of custody