which is the standard procedure to perform during the computer forensics investigation