During an investigation, an incident responder intends to recover multiple pieces of digital media.
Before removing the media, the responder should initiate:
A . malware scans.
B . secure communications.
C . chain of custody forms.
D . decryption tools.
Answer: C