Following an incident, an administrator is gathering forensic evidence from a server for a human resources investigation. Which of the following best practices...