john works as a junior analyst at xyz inc. during an investigation he fails to create a copy of a servers hard drive before removing the drive and sending it to the forensic department. Later the evidence from the analysis is not usable due to the uncertaintly of tampering. Which of the following should john have followed