Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a
workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident
is opened. Which of the following should have been done first?
A.
Notify the incident response team lead
B.
Document chain of custody
C.
Take a copy of volatile memory
D.
Make an image of the hard drive