If a destructive program is running that might be destroying evidence what should be done

The choices can be found elsewhere and as follows:

a. perform an immediate full backup

b. attempt to end the process

c. pull the power cable

d. record the destruction using a video capture of the screen

I think the correct answer is option a. If a destructive program is running that might be destroying evidence, then perform an immediate full backup.