The digital forensic investigation process: from identification to report

Why follow a process?

Digital evidence is easy to damage and easy to challenge. If an investigator skips steps, a lawyer or an internal panel can ask whether the evidence was changed, whether anything was missed or whether the conclusions are just opinion. A clear, repeatable process answers those questions in advance. The core principles say what must be true of evidence; the process says how you get there. NIST SP 800-86 describes four phases (collection, examination, analysis and reporting); many courses add identification and preservation at the start, giving the five stages below.

The stages

1. Identification. Work out what happened, what questions must be answered and where evidence might be: laptops, phones, servers, cloud accounts, network logs, CCTV. Check your legal authority to examine each source.
2. Preservation. Stop evidence being lost or changed. This can mean isolating a device from the network, placing a phone in a signal-blocking bag, extending log retention or asking a cloud provider to preserve an account.
3. Collection. Make verified copies, following the order of volatility. Disks are imaged through write blockers and hashed; see disk imaging. Record the chain of custody for every item.
4. Examination and analysis. Extract relevant data from the copies, such as files, emails, logs and artefacts, then interpret it to answer the questions. Build a timeline and test other explanations, not just the obvious one.
5. Reporting. Explain what was found, how and with what confidence, in language the audience can follow. In legal settings, the examiner may present the findings and answer questions about them.

Incident response and case work

In digital forensics and incident response (DFIR), the main question is "what did the attacker do and are they still here?". Speed matters, so analysts may collect targeted artefacts from many machines rather than full images of one. In case-driven work, such as an employee suspected of taking customer data, the question is about a person's actions, and the evidence may end up before an employment tribunal or court. Then procedure, legal advice and privacy rules come first. Many investigations start as one and turn into the other, so it is wise to work carefully from the beginning.

Documentation throughout

Notes are not a final step; they are written as you go. Record the date, time, who did what, which tools and versions were used, hash values, and anything unexpected. Good notes let another examiner repeat your work and reach the same result. They also protect you when your findings are questioned months later.

Real-world example: data taken by a leaver

A fictional recruitment agency suspects that a consultant who resigned copied the candidate database before leaving. HR and the agency's solicitor agree the questions and confirm the laptop is company property. The IT manager preserves it by powering it down and storing it in a sealed bag, and asks the email provider to keep the mailbox. An external examiner images the disk, hashes it and finds a USB storage device connected the evening before the resignation, followed by access to an export of the database. The report sets out the timeline, the artefacts and their limits, and it supports a civil claim.