A forensic expert is given a hard drive from a crime scene and is asked to perform an investigation. Which of the following is the FIRST step the forensic expert needs to take to protect the chain of custody?

• Make a forensic copy
• Create a hash of the hard drive
• Recover the hard drive data
• Update the evidence log