The investigator's first priority is to contain the threat while preserving the most volatile evidence. Since the computer is on, infected with malware, and connected to the network, it poses an immediate risk of spreading the malware or allowing a remote attacker to destroy evidence. Unplugging the Ethernet cable is the first logical step because it isolates the system from the network, effectively containing the threat. This action does not alter the state of the running system, thereby preserving critical volatile data in RAM (e.g., running processes, network connections, malware code) for subsequent live data acquisition.

A. Turn off the computer: This action would result in the immediate loss of all volatile data stored in RAM, which is crucial for analyzing the malware's behavior and collecting transient evidence.

C. Run malware removal tools: Running any software, especially an anti-malware tool, will significantly alter the system's state (e.g., modifying files, terminating processes, changing registry keys), thereby destroying critical evidence.

D. Copy files to external media: While data acquisition is a critical phase, it should only begin after the scene is secured. The immediate priority is containment to prevent remote tampering or data destruction during the acquisition process.

1. National Institute of Standards and Technology (NIST) Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response.

Reference: Section 3.1.2, "Initial Response," discusses containment strategies. It states, "One strategy is to let the affected system continue to run but to disconnect it from the network." This is recommended to prevent the attacker from causing more damage or spreading to other systems.

2. Request for Comments (RFC) 3227, Guidelines for Evidence Collection and Archiving.

Reference: Section 3, "Collecting the Evidence," outlines the "order of volatility." It implicitly supports preserving the running state of a machine to collect volatile data (e.g., network connections, running processes). Isolating the machine from the network is a prerequisite to safely performing this collection without external interference.

3. Carnegie Mellon University, Software Engineering Institute, Best Practices in Network Incident Response.

Reference: Document CMU/SEI-2002-TN-016, Section 3.2, "Containment." The document emphasizes that the first step after identifying an incident is containment, which often involves "isolating the affected network or system" to prevent further damage. This aligns with disconnecting the computer from the network as the initial action.