During an incident response, what is the BEST method to ensure that digital evidence remains unaltered and is available for legal analysis?
Using write blockers during data acquisition
Making multiple copies of the data
Disconnecting the devices from the network
Labeling the devices as 'evidence'