If a destructive program is running that might be destroying evidence what should be done

The choices can be found elsewhere and as follows:
a. perform an immediate full backup
b. attempt to end the process
c. pull the power cable
d. record the destruction using a video capture of the screen

I think the correct answer is option a. If a destructive program is running that might be destroying evidence, then perform an immediate full backup. 

*insert ribbon > table drop-down menu* would allow you to insert a quick table