A technician is dispatched to repair a malware infection on a laptop. The user appears agitated and uneasy about the technician working on the computer without supervision. Once the malware is…

Reporting through proper channels first ensures the incident is handled according to company policy and applicable legal requirements, protecting both the technician and the organization from liability. Taking independent action such as browsing files or copying data beforehand could compromise evidence integrity and create legal exposure for the technician.

Browsing the images constitutes an unauthorized privacy violation and could compromise the evidentiary chain of custody required for any subsequent legal investigation.

Contacting the security department may be the result of following proper channels, but acting on that step first bypasses the established reporting hierarchy, which may require notifying a supervisor or HR before security.

Copying images to an external device without authorization violates chain-of-custody procedures, company policy, and potentially laws governing evidence handling.