A system is suspected of compromise. Investigators may need evidence for disciplinary or legal proceedings. What is most important during collection?

1. Publish all evidence to accelerate review
2. Preserve integrity and document custody, source, timing, and handling
3. Rely only on an investigator's memory
4. Let every responder copy and edit the only evidence set