During the collection phase of the forensic process, data related to a specific event is labeled and recorded to preserve its integrity. This step ensures that the data remains unaltered and authentic from the time of collection until it is presented as evidence, maintaining the chain of custody. Reference:= Cisco Cybersecurity Operations Fundamentals - Module 6: Security Incident Investigations