During an incident response, what is the BEST method to ensure that digital evidence remains unaltered and is available for legal analysis?
Making multiple copies of the data
Labeling the devices as 'evidence'
Disconnecting the devices from the network
Using write blockers during data acquisition