Computer forensics require which of the following are MAIN steps?

Announcing incidents and assimilating data for correlation are incident response activities, not the primary forensic evidence-handling steps, and this option omits the critical evidence preservation and authentication phases.

Containing damage and announcing incidents are components of the incident response lifecycle (e.g., NIST SP 800-61), not the core steps of computer forensics, which must prioritize evidence integrity over operational response actions.

The three main steps of computer forensics are: (1) Acquire the data without altering it - preserving the original evidence using write blockers or forensic imaging to maintain integrity; (2) Authenticate the recovered data - using cryptographic hashing (e.g., MD5, SHA-256) to verify the copy is identical to the original; and (3) Analyze the data - examining the authenticated copy for evidence. This sequence ensures a forensically sound process that is admissible and reproducible.

While accessing data before destruction has some relevance, 'assimilating data for correlation' and 'containing damage' belong to incident response workflows, and this option fails to address authentication, which is essential to forensic soundness.