Following a malicious security incident, an organization has decided to prosecute those responsible. Which of the following will BEST facilitate the forensic investigation?

A. Performing a backup of affected systems
B. Identifying the affected environment
C. Maintaining chain of custody
D. Determining the degree of loss