– Identify, gain access and secure any necessary devices or systems to be examined.
– Reconstruct damaged hardware, if necessary.
– Copy or use other means to ensure data is not changed during the analysis.
– Recover the target information and assess the credibility and completeness of the data.
– Identify and document any metadata associated with the files, such as date of creation, owner, etc.
– Document any other findings or discovered files or communications which may be relevant.
– Ensure that all work is done in compliance with local and federal laws and forensic standards.
– Collect the information in a legally admissible way.
– Provide an audit trail.
– Compile and secure the evidence and write structured reports acceptable for court.
– Advise and train law enforcement and legal staff on forensics.