explained the issue of correlation between digital investigation tools and then proposed a framework for automatic evidence identification with support of different targets. The implemented prototype presents the integrated analysis of configuration log file, memory image, disk image and network traffic captures.