Assembling the hardware and software required to conduct an incident investigation would occur in the __________________ incident response phase.
a. preparation
b. detection
c. containment
d. recovery