Joe an employee has reported to Ann a network technician an unusual device plugged into a USB
port on a workstation in the call center. Ann unplugs the workstation and brings it to the IT
department where an incident is opened. Which of the following should have been done first?

A.
Notify the incident response team lead

B.
Document chain of custody

C.
Take a copy of volatile memory

D.
Make an image of the hard drive