The Digital Forensics Process

March 25, 2026— Jason Pell, Senior Cybersecurity Engineer 5 min read

Digital forensic (DF) examinations may be needed during many different types of investigative incidents, including corporate, government, or other individual incidents that involve unethical or criminal activities. The examiner may need to perform a DF investigation on a suspect’s smartphone and search for evidence related to a crime. A company may suspect an employee has been committing corporate espionage and require the individual’s computer to be forensically examined and searched for the intellectual property. Or a government organization may suspect that malware might be present on one of their employees’ computers and require a full examination of the hard drive.

Whatever situation requires a DF examination, the full DF process normally involves four primary steps: collection, examination, analysis, and reporting. The National Institute of Standards and Technology (NIST) SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, provides guidance on these basic phases to assist professional DF analysts with their examinations.

The Digital Forensics Process, from NIST SP-800-86

Let’s do a quick walk-through of the four phases using both an investigation scenario and an “image” file (binary copy of a hard drive) that contains suspected criminal evidence, which was downloaded from the NIST Computer Forensic Reference DataSet Portal, a website NIST has stood up for assisting with DF tool testing and general practitioner training. In this scenario, the DF examiner is investigating Mr. Jimmy Wilson, who is suspected of illegal activities including drug use and possibly other nefarious deeds. The DF examiner has been granted a search warrant giving authorization to search the entirety of the suspect’s hard drive once a chain of custody has been established, and the drive is given to the examiner by the police computer incident response (IR) team.

Collection: Identify and Acquire

The IR team arrived at Mr. Wilson’s home and immediately started to identify any potential source of data and media where they suspected evidence could be found. This is known as the collection phase, where the most obvious sources of data include Mr. Wilson’s laptop, PC, smartphone, CDs, or external drives. There are also logs of network activity from Internet service providers (ISPs) or other organizations that may be deemed essential for collection. When identifying media sources that are still powered on, a memory collection is an optimal task for collecting system activities (processes, network connections, live internet sessions, etc.) in real-time. If any other media or logging can be identified, such as centralized logging or keystroke monitoring logging, those logs should also be collected during this phase. Fortunately for Mr. Wilson, the only media available for searching was his personal computer, a Windows system that the IR team collected for the examination.

Once the personal computer was collected and handed over to the DF examiner, it was time for the DF examiner to “acquire” the data, which consisted of imaging the computer’s hard drive. The system had been powered off, so no volatile data (data residing in the computer’s RAM) could be collected. The DF examiner used a TX2 Forensic Imager to make an exact bit-by-bit copy of the hard drive and then verified the integrity of the data by performing a message digest check of the original and the copied data and comparing the values to ensure that they are the same.

The TX2 Forensic Imager

Examination: Which data Pieces are Pertinent

The examiner’s next step after he verified data integrity was to examine the collected data so that he could assess and extract the relevant data from the drive. The examiner ultimately decided that since the warrant stipulated evidence could be acquired from the entire drive, he concluded that the entire data image was valuable for the investigation, and a full examination of the suspect’s hard drive would be needed to find any essential evidence of criminal activity. This included the drive volumes, system files, and user folders and directories. Windows registry data would also be the subject for collection during this examination.

Jimmy Wilson’s Drive Volumes- Pertinent Data

Analysis

By far, the analysis portion is likely the most tedious portion of the DF process, as it involves a “deep dive” of the data, and drawing conclusions from it by identifying people, places, events, timelines, and user activity that shows evidence of the suspect activity. These items that give illumination into the events of the activity are called artifacts, and it is the DF examiner’s job to locate these artifacts within the drive to present as evidence during the reporting phase. Some common locations on a Windows system include the “low hanging fruit” of the user directories and folders, email, Windows activity logs, internet browsing history, and basic system files. Other known artifact locations, such as the Windows Registry and file system journals, can present valuable information that could tie the user or other contacts to the activities that they are being suspected of. For a list of these important locations, see the SANS Windows Forensics Analysis site here.

A Random PDF File Found Under User Jimmy Wilson’s Documents Folder

Reporting

Once the analysis has been completed, it’s time for the DF examiner to prepare and present the results of the analysis in a report, and include the evidence found during the analysis phase. There are several factors to consider when reporting the results. The examiner must consider the viewers that will be shown the information and must detail the report in accordance with the type of audience. Organizations such as government and law enforcement will require more detailed reports, although management teams may want a more strategic report for the evidence found. The examiner should also consider giving more than one explanation of the results and produce an alternative explanation to cover any events with two or more plausible explanations. The examiner should also identify future actionable information (i.e., list of contacts, malware) that could help prevent similar events in the future.

For further information on the Digital Forensics Process, see NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response.