First Response – The first and foremost action of the Digital forensics team is following a security incident. The initial action performed exactly after the occurrence of a security incident is known as the first response. It is very much reliant on the nature of the incident.
Search and Seizure –In the second phase, the forensics team tries to search the affected devices and seizes them so that the perpetrators/criminal can’t continue to act. Under this phase, the professionals search for the devices occupied in carrying out the crime. So that the affected devices can carefully be seized to extract information out of them.
Evidence Collection –After the search and seizure phase, experts use the acquired devices to collect data using definite forensic methods for evidence handling. It mainly includes things like what and where the evidences are present, where it is stored like computers, Mobile phones, PDAs, and lastly, how it is stored (in which format).
Data Acquisition – The Digital Forensic team cautiously retrieves and achieves the electronically stored information (ESI) by the subsequent standard procedures to minimize the risk of accidental altering of data that would damage the integrity of the evidence. It refers to the process of retrieving Electronically Stored Information (ESI) from suspected digital assets which helps to gain insights into the incident while an inappropriate process can alter the data, thus, sacrificing the reliability of evidence.
Data Analysis – Data Analysis is the phase where the experts scan the acquired data to identify the evidential information to draw conclusions. Though, it might take many alterations of examination to analyze and support a specific crime theory after examining, identifying, separating, converting, and modeling data to transform it into constructive information.
Evidence Assessment – After analyzing the certain amount of data, identified as evidence, investigators or experts then assess and evaluate its relation to the case. The process of evidence assessment connects the evidential data to the security incident.
Documentation and Reporting – It is the post investigation phase where all of the findings and related data are appropriately documented. Additionally, the report should have sufficient and acceptable evidence in accordance to the court of law which helps in recreating the crime scene and reviewing it. It covers proper documentation of the crime scene along with photographing, sketching, and crime-scene mapping
Expert Witness Testimony – An expert witness Testimony represents a person who has knowledge and awareness about the field relating to the case, and can assure that the data provided is useful as evidence in court. The Digital Forensic investigators should approach the expert witness to confirm and establish the accuracy of evidence.
To conclude the phases of Digital Forensics, the Forensics investigators identify the incident firstly to search and seize the affected devices, extract and take out the important data they may contain, and save it onto a safe drive. Once the data is secure, the analysis and documentation take place for the final report to the police or present it.
