While working on an incident, Joe, a technician, finished restoring the OS and applications on a workstation from the original media. Joe is about to begin copying the user`s files back onto the hard drive. Which of the following incident response steps is Joe working on now? 

Answer options:

A. Recovery
B. Eradication
C. Containment
D. Identification

A