Which of the following is a fundamental principle of disk & memory forensics as it applies to Certified Cyber Professional?