Had to look for the options and here is my answer. Based on digital forensics's basic methodology, the very first thing that should be done upon investigation is the identification of relevant items of evidentiary value or known as EM. Hope this answers your question.
