Which of the following steps are generally followed in computer forensic examinations?