In judicial practice,investigators commonly take "two-steps" approach in gathering digital evidence that lived in the running computer at crime scene,that means the investigator just implement the duty of unplug the running computer and book it into the evidence facility,from there,the investigator requests that the computer be examined by a trained digital evidence examiner.