Two teams respond to identical malware alerts. Team 1 isolates the device, removes the cause, restores from a clean image, and reviews gaps. Team 2 restores first and isolates later. Which evaluation is best?