Each step of the forensic investigation displays a good reflection of the forensic process and is documented in a chain of custody form. When a crime is discovered, law enforcement or a detective obtains the evidence and transports it to a forensic investigator where it is securely placed and examined. As the evidence is transported through different people and places it is securely prepared, collected, preserved, analyzed, collected, and reviewed to hold the value of the chain of custody. The first stage of the process is identification, which recognizes an incident from indicators and determines its type and location of the relevant data that can be used as evidence. This can include devices such as computers, USB drives, smartphones, and videogame consoles. From this information investigators can properly identify the appropriate recovery methodologies and the tools (“Computer Forensics” n.d). At this step of the investigation process the goal is determine what the evidence forensic investigators are working with. The proper way to approach this would be determine the kind of electronic device is apart of the investigation. The second stage of the process is preparation that would include the preparation of tools, techniques, search warrants, and monitoring authorizations and management support. This stage is crucial to the forensic investigators because …show more content…
Digital electronic bags can be used as a placeholder to put the digital evidence inside to transport the evidence from where it was discovered to where it will be preserved and analyzed. The collection step entails the recording of the physical scene and duplicates digital evidence. Once the location of the data has been identified, an investigator will apply the appropriate collection technique or tool to capture the digital evidence. This could include imaging software that captures every sector of a hard drive and creating multiple backup copies. At this step the chain of custody is very important to make sure the data being collected is preserved and not modified on purpose or accident. It is essential in the preparation steps to have formed an outline of how to approach the data in the least crucial way. The next stages are examination and analysis, which involves an in-depth systematic search of evidence relating to, suspected crime and determination of the significance, reconstructing fragments of data and drawing conclusions based on the evidence found. After collecting the evidence law enforcement securely hands over evidence to a forensic