Collecting Evidence In Response To A Security Incident

What should be created when collecting evidence in response to a security incident?

Chain of custody