A network technician was tasked to respond to a compromised workstation. The technician
documented the scene, took the machine offline, and left the PC under a cubicle overnight. Which of
the following steps of incident handling has been incorrectly performed?
A.
Document the scene
B.
Forensics report
C.
Evidence collection
D.
Chain of custody