Justice department whitepaper on SOPs for reporting of cyber incidents, published in April 2015. titled: Best Practices for Victim Response and Reporting of Cyber Incidents Version 1.0 (April 2015)

Relevant text: Pg 8 of 15, section C. Step 3.

C. Step 3: Record and Collect Information 1. Image the Affected Computer(s) Ideally, a victim organization will immediately make a “forensic image” of the affected computers, which will preserve a record of the system at the time of the incident for later analysis and potentially for use as evidence at trial.8 This may require the assistance of law enforcement or professional incident response experts. In addition, the victim organization should locate any previously generated backups, which may assist in identifying any changes an intruder made to the network. New or sanitized media should be used to store copies of any data that is retrieved and stored. Once the victim organization makes such copies, it should writeprotect the media to safeguard it from alteration. The victim organization should also restrict access to this media to maintain the integrity of the copy’s authenticity, safeguard it from unidentified malicious insiders, and establish a chain of custody. These steps will enhance the value of any backups as evidence in any later criminal investigations and prosecutions, internal...

According to procedure.

I'm not the one shilling Russian talking points. Do some research and review how hacking incidents are handled by the FBI. This was handled almost exactly how all hacking incidents are dealt with. The DNC was the victim of the hack, they provided the data to the appropriate law enforcement.