What must an investigator do before disconnecting an iPod from any type of computer?

A forensics investigator needs to copy data from a computer to some type of removable media so he can examine the information at another location. The problem is that the data is around 42GB in size. What type of removable media could the investigator use?

Which one of the following is not a first response procedure?

Jim performed a vulnerability analysis on his network and found no potential problems. He runs another utility that executes exploits against his system to verify the results of the vulnerability test.
The second utility executes five known exploits against his network in which the vulnerability analysis said were not exploitable. What kind of results did Jim receive from his vulnerability analysis?

Watson, a forensic investigator, is examining a copy of an ISO file stored in CDFS format. What type of evidence is this?