A technician documents the findings of illegal material that was found on a workstation. Which of the following should the technician do NEXT when storing the workstation?

Setting users to administrators is irrelevant to preserving evidence and would constitute unauthorized modification of the system.

Destroying the hard drive would destroy the evidence and could result in legal liability for the technician and the organization.

Reimaging the workstation destroys all forensic evidence, making it impossible to investigate or prosecute.

Chain of custody is a legal and forensic requirement that ensures evidence (the workstation and its data) is handled, documented, and stored properly so it remains admissible. Adhering to chain of custody means securing the device, documenting who had access, and transferring it to the appropriate authority without alteration.