Making a copy of the computer system in question as early as possible to prevent contamination (unlike in the case of Julie Amero where the investigator worked directly off Amero's hard drive rather than creating a forensic image of the drive.[1] Mounting as a second disk onto another machine for experts to run a standard anti-virus program.