Giving the forensics investigator documentation of items the investigation officers collected with the computer, notes the computer specifications, if the machine was running when discovered. Before shutting the machine down, photographs the open windows that were running.