Which one of the following is not a first response procedure?

Office documents (Word, Excel, PowerPoint) contain a code that allows tracking the
MAC, or unique identifier, of the machine that created the document.
What is that code called?

What method of copying should always be performed first before carrying out an investigation?

Casey has acquired data from a hard disk in an open source acquisition format that allows her to generate compressed or uncompressed image files. What format did she use?

Volatile information can be easily modified or lost when the system is shut down or rebooted. It helps to determine a logical timeline of the security incident and the users who would be responsible.