Please help me answer

5. As a digital forensics analyst, you are invited to participate in a raid where computers are suspected as being used in a criminal enterprise. When the raid is conducted, the computers are being used by potential suspects, so they are on and operating. Once the police have the potential suspects under control, you have to decide what evidence to collect a. Outline for me all of the procedures that you would take to ensure that the maximum amount of evidence is obtained from the computers on the premises. Be thorough and make sure you think of anything that might help in your investigation b. What tools would be helpful in your activities