Ted needs to preserve a server for forensic purposes. Which of the following should he not do?

To properly preserve the system, Ted needs to ensure that it does not change. Turning off the system will cause anything in memory to be lost, which may be needed for the inves- tigation. Removing the drive while a system is running can cause data to be lost. Instead, live-imaging the machine and its memory may be required. Allowing users to continue to use a machine will result in changes, which can also damage Ted’s ability to perform a forensic investigation.