A phishing message reached several mailboxes. Which investigation approach best establishes impact without exposing the analyst?

1. Use Defender email investigation data to examine recipients, URLs, attachments, and related activity
2. Delete the original report before recording evidence
3. Review the subject line only
4. Open every attachment on an ordinary workstation