Final answer:
The first step in a chain-of-custody protocol is to meticulously document who took possession of the computer, the time and date it was taken, and the specific circumstances surrounding its seizure.
Step-by-step explanation:
The first step in a chain-of-custody protocol when it becomes necessary to take a computer out-of-service for legal purposes is to document the process. This documentation should begin with a detailed record of who took possession of the computer, when it was taken, and under what circumstances. This ensures that the integrity of the evidence is maintained and that all subsequent handlings of the computer are logged. It's essential to maintain this chain-of-custody to ensure that the evidence is admissible in court and that no unauthorized individuals have had access to it.