A forensics investigator has been assigned the task of investigating a system user for suspicion...

Notify the user that their workstation is being confiscated to perform an investigation, providing no details as to the reasoning.

Confiscate the workstation while the suspected employee is out of the office, andperform a search on the asset.

Confiscate the workstation while the suspected employee is out of the office, and perform the search on bit-for-bit image of the hard drive.

Notify the user that the workstation is being confiscated to perform an investigation, providing complete transparency as to the suspicions.