Illegal content is not permitted on work computers, according to company policy. You have discovered the presence of illegal content on a user's workstation and seized the workstation from him. What should you do to make sure that the illegal material is handled properly and given to the appropriate authorities?

Someone must keep track of the device or data once it has been preserved before turning it over to the appropriate authorities. Depending on your documented chain of custody policy, the next step will vary. Materials may be kept in a safe, locked area at the office, or they may have to be delivered to the appropriate authorities, depending on the circumstance. You should have a documented procedure that you may follow in any situation. Always document the findings, who has custody of the illegal materials, and whether or not the custody is transferred to someone else.