a. Talk to others involved in the case and ask about the incident.
b. Determine whether law enforcement or company security officers already seized the computer evidence.
c. Determine whether the computer was used to commit a crime or contains evidence about the crime.