Following are the general tasks investigators perform when working with digital evidence:
• Identify digital information or artifacts that can be used as evidence.
• Collect, preserve, and document evidence.
• Analyze, identify, and organize evidence.
• Rebuild evidence or repeat a situation to verify that the results can be reproduced
reliably.