A forensic team defines retention rules for logs before incidents. Why?

A. To ensure useful evidence is available later B. To hide attacks C. To increase file size only D. To avoid compliance