A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take the chain of custody?

Making a forensic copy is a critical technical step in the investigation to preserve the original evidence, but it occurs after the evidence has been formally logged into the chain of custody.

Creating a hash of the hard drive is a technical integrity verification step, typically performed on the original and/or the forensic copy, and not the initial administrative step for chain of custody documentation.

Recovering hard drive data is a later analytical phase of the investigation, performed on the forensic copy, and is not the initial step for documenting the chain of custody.

Updating the evidence log is the immediate and fundamental first step in establishing or continuing the chain of custody. This action formally records when the evidence was received, by whom, and its condition, which is crucial for maintaining a documented history of possession and integrity.