The workflow of a digital forensic investigation is more standard than it looks. The names change between providers; the substance does not. Knowing the stages makes it easier for solicitors to scope work, control cost and answer questions from clients about what is happening and why.
The stages
- Instruction and scoping: framing the questions the report will answer.
- Identification: what devices, accounts and services are in scope.
- Preservation: sealed, hashed copies of the relevant sources.
- Analysis: interrogation of the images against the pleaded issues.
- Reporting: a written report to the relevant procedural standard.
- Testimony, if the report is challenged.
Where the cost really sits
Analysis, not extraction. A tightly scoped instruction reduces analysis time more than any other single factor. A general instruction to examine the device produces a general and expensive report.