A network technician was tasked to respond to a compromised workstation. The technician
documented the scene, took the machine offline, and left the PC under a cubicle overnight. Which of
the following steps of incident handling has been incorrectly performed?

A.
Document the scene

B.
Forensics report

C.
Evidence collection

D.
Chain of custody