What method of copying should always be performed first before carrying out an investigation?

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Identify the file system that uses $BitMap file to keep track of all used and unused clusters on a volume.

Which of these rootkit detection techniques function by comparing a snapshot of the file system, boot records, or memory with a known and trusted baseline?

Which of the following commands shows you the names of all open shared files on a server and the number of file locks on each file?