During a forensic investigation, which of the following must be addressed FIRST according to the order of volatility?