A technician received a call stating that all files in a user's documents folder appear to be changed, and each of the files now has a .lock file extension. Which of the following actions is the FIRST step the technician should take?


A. Run a live disk clone.
B. Run a full antivirus scan.
C. Use a batch file to rename the files.
D. Disconnect the machine from the network.