Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a workstation in the call center. Ann unplugs the
workstation and brings it to the IT department where an incident is opened. Which of the following should have been done first?

A.
Notify the incident response team lead

B.
Document chain of custody

C.
Take a copy of volatile memory

D.
Make an image of the hard drive