The security manager received a report that an employee was involved in illegal activity and has saved data to a workstation's hard drive. During the investigation, local law enforcement's criminal…

Chain of custody is the documented process that tracks who has possession of evidence at every point in time, from collection through investigation and trial. When law enforcement confiscates the hard drive, a chain of custody record must be established and maintained to ensure the evidence is legally admissible. This procedure documents the transfer of the drive from the organization to law enforcement.

System image refers to creating a forensic bit-for-bit copy of a drive before analysis, not the act of transferring physical evidence to another party.

Taking hashes is a verification step to confirm data integrity of a forensic image, not a procedure for transferring physical evidence.

Order of volatility defines the sequence in which digital evidence should be collected based on how quickly it disappears, not physical evidence handoff.