A security analyst captures forensic evidence from a potentially compromised system for further investigation. The evidence is documented and securely stored to FIRST:

Maintaining the chain of custody is a crucial subsequent process that tracks access to the evidence, but it relies on the data first being properly preserved in its original state.

Documenting and securely storing forensic evidence immediately upon capture is the first critical step to prevent any alteration, degradation, or loss of the original data. This action ensures the evidence's integrity, making it reliable and admissible for subsequent investigation and potential legal proceedings.

Obtaining a legal hold is a legal directive to retain relevant information, which is distinct from the immediate technical action of securely storing physical evidence for preservation.

Recovering data implies restoring lost or inaccessible information, whereas forensic evidence is captured and preserved for analysis, not necessarily for restoration from a lost state.