When gathering digital evidence it is very important to do the following: (Choose all that apply)

Shutting down a compromised system destroys volatile data (like RAM contents, active network connections, running processes) that can be crucial evidence in a forensic investigation.

Rebooting a system, even offline, changes the system's state and can overwrite or destroy volatile evidence, making it an improper first step in digital evidence collection.

Documenting the chain of evidence, including who handled the evidence, when, and where, is absolutely critical to maintain its integrity and admissibility in legal proceedings.

Performing a bit-level backup (or forensic image) creates an exact, forensically sound duplicate of the original storage media, preserving all data, including deleted files and metadata, before any analysis can alter the original.