Which of the following incident response phases should the proper collection of the detected IOCs and establishment of a chain of custody be performed before?
a) Containment
b) Eradication
c) Recovery
d) Preparation