A user has powered off their computer after a suspected attack and breach. A technician has
been assigned to pick up the PC and deliver it to the corporate office. Which of the following
should the technician do after receiving the PC?

A.
Record what the user experienced, the times they experienced it and the effects of the
breach

B.
Image the drive and create a drive hash to prove the contents were not changed in transit

C.
Document the customer and technician’s names, what was received, and the time

D.
Remove the hard drives as they will be installed into a PC on a “Safe LAN” in the
corporate office