312-39V2: Certified SOC Analyst v2

At GlobalTech, a multinational corporation, the SOC team identifies a suspected ransomware outbreak affecting multiple endpoints. After the infected systems are successfully isolated from the network, the Digital Forensics team, led by Ray Martinez, starts its investigation. They deploy a forensics workstation to acquire RAM dumps, extract Windows Event Logs, and collect network PCAP files from the compromised hosts. Which Incident Response lifecycle phase is now underway?