Which of the following should be done FIRST following an incident that has caused internal...

Document the servers' dates, times, and locations, as well as the individual who last used them

Make a bit-level copy of the affected servers and calculate the hash value of the copy.

Copy all key directories and files on the affected servers and generate the hash value of the copy.

Unplug all power cables immediately to prevent further actions of the attacker on the servers.