Accordingly to Whitman and Mattord the containment phase is the third stage of the incident response phase. Two-bit level copies of the system's hard drive will be made once the system is in the possession of the incident-handling team. What are the two copies and why are they made?