Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a
workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident
is opened. Which of the following should have been done first?
Notify the incident response team lead
Document chain of custody
Take a copy of volatile memory
Make an image of the hard drive