An investigator collects a hard drive from a crime scene and needs to ensure the digital evidence will be accepted in a court of law. According to the described digital forensics process, which step directly follows Identification and is critical to preventing tampering by cyber criminals?