Forensic Investigation Process and Methodology

The forensic investigation process and methodology is a set of predefined, systematic steps that investigators follow to ensure digital evidence is collected, preserved, analysed, and presented in a way that is legally admissible in court. Think of it as a recipe that cannot be altered: if you add ingredients in the wrong order or skip a step, the dish is ruined. In digital forensics, the 'dish' is the evidence that proves or disproves a crime.

The process is broken into distinct phases. The exact number of phases varies slightly depending on which framework you use, but the 312-49 exam tests a specific model with six main phases: 1) Pre-Investigation, 2) Preservation, 3) Collection, 4) Examination, 5) Analysis, and 6) Presentation. There is also a seventh, overarching phase called 'Chain of Custody' that runs through every single stage.

Pre-Investigation is what happens before you even touch a computer. This includes getting legal authorisation — a warrant or written consent — to search the device. Without this, any evidence you find is illegal and cannot be used. You also prepare your tool kit: forensic imagers, write-blockers (hardware that prevents you from accidentally writing data to the suspect drive), and clean storage media. This phase is often forgotten by beginners, but on the exam, it is one of the most tested concepts.

Preservation is the step where you freeze the digital crime scene. You must not let any data change. The moment a computer is turned on, data changes — logs are written, timestamps update, temporary files are created. So the first thing you do in preservation is to not touch the power button. You photograph the screen, you label every cable, you document the state of the system. Then you create a 'forensic image' — a bit-for-bit copy of the hard drive. This is not a normal file copy; a normal copy misses hidden data, metadata, and deleted files. A forensic image captures everything, including empty space and deleted file fragments.

Collection is the physical act of gathering the evidence. This includes the hard drive, USB sticks, mobile phones, network logs, and any paper notes near the computer. Each item gets a unique evidence tag, a description, and the date/time of collection. Every transfer of evidence between people must be recorded. This recorded history is called the 'Chain of Custody'. If the chain is broken — say, an officer takes the drive home overnight without logging it — the defence can argue the evidence was tampered with.

Examination is the technical phase where you extract data from the forensic image without altering the original. You use specialised software like FTK (Forensic Toolkit) or EnCase. You recover deleted files, you carve out fragments from unallocated space (areas of the drive that the operating system marks as free), you crack passwords, and you sort through thousands of files. The key rule is: you never work on the original drive. You always work on the copy.

Analysis is where you turn raw data into findings. You build a timeline of user activity: when files were created, modified, or accessed. You look for patterns: why did the user delete those specific files at 2 AM? Did they try to overwrite data with a wiping tool? You correlate logs from different sources — a server log, a router log, and a user's browsing history all might tell the same story.

Presentation is the final step. You write a report that a judge, jury, and lawyers can understand. No jargon. You explain exactly what you did, what you found, and what it means. You must be able to defend every tool choice and every finding in court. If you cannot explain why you chose a particular hashing algorithm to verify the image, the credibility of your entire investigation collapses.

Finally, every step is documented. Documentation is not a separate phase — it is a continuous requirement. You write down everything: the time you arrived, the temperature of the room, the serial numbers of drives, the software versions you used. If it is not written down, it did not happen in the eyes of the law.

An IT security analyst at a medium-sized accounting firm receives an alert at 2:47 PM: an employee named Sarah has been accessing client tax records that are completely outside her department. The CEO wants to know if this is an insider threat or a compromised account. The analyst cannot just log into Sarah's computer and start poking around — that would be a forensic disaster. Instead, she follows the forensic process and methodology.

First, Pre-Investigation: the analyst calls the legal department to get a written authorisation. Within one hour, legal provides a signed directive authorising the forensic collection of Sarah's laptop and her network activity logs. The analyst prepares a forensic write-blocker and a clean 2TB external drive for imaging. She also notifies HR in case termination or suspension is required later.

Preservation: the analyst asks Sarah's manager to ask Sarah to step away from her computer for a meeting, but not to shut it down. The analyst then walks to Sarah's desk, photographs the screen — which shows an open tax return for a client Sarah has no business knowing — and labels each cable with coloured tape before disconnecting them. She does not log off or close any windows; she documents what is open and leaves the machine in its running state. She then removes the hard drive and connects it to her forensic workstation via the write-blocker to create a forensic image.

Collection: the analyst tags the original drive as evidence item E-001 and also takes Sarah's mobile phone (company-issued), a USB stick found in the desk drawer (item E-002), and the network logs from the past 72 hours (item E-003). Each item is logged in the chain-of-custody spreadsheet with the date, time, and name of the person who collected it.

Examination: the analyst runs FTK Imager on the forensic copy. She recovers 34 deleted PDF files from unallocated space. Most are client tax returns from the last month. She also finds a file called 'clients_to_sell.xlsx' that was created at 3:15 AM on Tuesday and then deleted 15 minutes later. She extracts the file and notes its contents: a list of high-net-worth clients with their contact details and tax identification numbers.

Analysis: the analyst cross-references the timestamps from the deleted file with the network logs. At 3:20 AM on Tuesday, there was a USB drive connected to Sarah's laptop — the USB stick from her drawer. The network logs show no outbound transfer of large files, suggesting the data was copied locally to the USB stick, not emailed. The analyst also checks Sarah's email for any suspicious messages and finds none. The conclusion: Sarah was exfiltrating client data via USB for personal gain, not for a third party.

Presentation: the analyst writes a 15-page report summarising the methodology, the evidence collected, the findings, and a timeline of events. She includes screenshots, hashing verification results, and a chain-of-custody log. She presents this to the CEO and legal counsel. Sarah is terminated and the firm notifies affected clients. Because every step of the forensic process was followed correctly, the evidence could be used in any potential civil lawsuit or criminal referral without being challenged.