A forensic investigation proceeds in several clearly defined steps. It begins with the formulation of a specific question. Next, potential digital evidence is identified, documented, and secured. Only then does the technical analysis take place. Finally, the relevant findings are evaluated, chronological relationships are reconstructed, and the results are documented in a comprehensible manner.

The exact procedure depends on the device being examined, the available data sources, and the specific question being addressed. A smartphone requires different backup and extraction methods than a Windows PC, an SSD, a server, or a cloud account. Nevertheless, professional investigations follow certain fundamental principles.

It is crucial not to rush into the analysis. Proper digital forensics begins with planning the investigation and handling the source material in a controlled manner.

1. The question is defined.

Before any technical investigation, it must first be clarified what exactly is to be determined. A vague instruction like "check everything" is of little practical use when dealing with extensive digital systems. Modern computers and smartphones can contain millions of files, system information, databases, and technical artifacts.

A specific question might be, for example, whether a particular USB stick was connected to a computer, whether files were copied or deleted before a termination, whether there is evidence of unauthorized access, or whether certain messages are still technically present on a smartphone.

The research question determines which data sources are relevant, which backup method is chosen, and how far the analysis needs to go. It also helps to avoid unnecessary interventions in irrelevant datasets.

2. Relevant devices and data sources are identified.

The next step involves determining which devices, storage media, or accounts might be relevant to the investigation. This could include computers, laptops, smartphones, tablets, external hard drives, USB flash drives, memory cards, servers, NAS systems, email accounts, or cloud services.

In companies, it can also be relevant which user accounts, network shares, log files, or backup systems exist. For smartphones, in addition to the device itself, local backups, cloud data, or connected accounts can also play a role.

Caution is required even at this stage. If devices are used, started, or modified without supervision, existing traces can be altered. The appropriate measures depend heavily on the specific state of the system.

3. The initial state is documented.

Before digital evidence is examined, its initial state should be documented. This can include manufacturer, model, serial number, visible device condition, connected components, power-on state, and other identifying characteristics.

With the system powered on, additional relevant information includes which programs are open, whether the device is connected to a network, and whether encrypted storage media have already been unlocked. Such information can be crucial for selecting the appropriate backup method later.

The documentation serves to make it possible to trace later the condition in which the device was received and what measures were subsequently taken.

4. The digital evidence is secured.

Documentation is followed by data backup. The goal is to create a suitable basis for investigation and to protect the original from unnecessary changes as far as technically possible.

For traditional hard drives or other data storage media, a forensic image can be created. Depending on the subject of the investigation, a sector-by-sector or bit-by-bit copy of the addressable data carrier can be generated.

Smartphones have different technical requirements. Depending on the device and access options, backup can be performed using methods such as logical extraction, file system extraction, or, in certain cases, more advanced techniques.

For servers, running systems, or cloud services, live backups may be necessary. There is no single backup method that works for all digital systems.

5. Write accesses are controlled as far as possible.

A key principle of digital forensics is to avoid unnecessary alterations to the original document. Hardware or software write blockers can be used on suitable storage media to prevent write access to the source medium.

With modern smartphones and running systems, a completely write-free examination is not always technically possible. Even unlocking a device, starting a forensic service, or certain extraction procedures can cause changes.

A professional investigation must therefore not claim technically unrealistic freedom from change. The crucial point is to identify unavoidable changes, minimize them, and document them in a comprehensible manner.

6. The integrity of the backup is checked.

Cryptographic hash values ​​are frequently used in forensic imaging. A hash value is a checksum calculated from a data set. If the same data set is later hashed again using the same method, the same value should result.

This allows verification of whether the backed-up data has changed since the calculation. Hash values ​​are therefore an important tool for integrity control.

However, a hash value does not automatically prove that the content of a file is authentic or that a specific person created that file. It primarily refers to the integrity of the data being examined.

7. The actual forensic analysis begins.

Only after the data has been secured does the systematic technical analysis begin. Wherever possible, work is carried out not on the original, but on a forensic backup or working copy.

Depending on the specific question being addressed, the investigation can encompass a wide variety of data sources. These include file systems, user profiles, system logs, application data, browser information, emails, messenger data, connected storage devices, timestamps, and other technical artifacts.

Professional forensic software helps to structure large amounts of data and interpret known data formats. However, the software does not automatically provide the correct conclusion. The actual evaluation remains the responsibility of the investigator.

8. Files and file systems are examined.

For computers and data storage devices, file system analysis is often one of the key steps in the investigation. This allows for checking which files are present, when they were created or modified, and what additional file system information is available.

Under certain conditions, even deleted files, file remnants, or data that is no longer regularly referenced can be identified. However, whether recovery is possible depends on the storage medium, file system, overwriting, and other technical factors.

With SSDs and flash storage devices, mechanisms such as TRIM and garbage collection can significantly limit recovery.

9. User activity is reconstructed

Many investigations focus on the question of what activities have taken place on a device. Operating systems and applications generate various technical traces in this regard.

Depending on the system, information such as user logins, recently used files, connected USB devices, launched programs, browser activities, or other user actions may be present.

Individual artifacts should not be overemphasized. For example, the presence of a connected USB device does not automatically prove that a specific file was copied to that device.

10. Timestamps and events are evaluated.

Time information plays a central role in forensic investigations. Files, operating systems, databases, and applications can store different timestamps.

These include, among other things, creation, modification, and access times, as well as internal event times. These values ​​must be interpreted within the context of the respective system.

Time zones, daylight saving time, synchronization, copying processes, software behavior, and potential manipulation can all affect timestamps. Therefore, a timestamp should not be considered conclusive proof of a specific user action without further verification.

11. A timeline can be created.

In more complex situations, relevant events are often compiled into a chronological overview. Such a timeline can combine information from different sources.

For example, file system data, Windows event logs, USB traces, browser data and application information can be compared over time.

Correlating multiple independent data sources can significantly increase the validity of a reconstruction. At the same time, contradictory data must be considered and explained.

12. Deleted data is checked.

If deleted data is relevant to the question at hand, an investigation will be conducted to determine whether any technically usable information still exists. This could include files, photos, messages, database entries, or other data.

However, deleted data cannot be automatically recovered. With magnetic hard drives, freed storage areas may still contain data under certain conditions. With modern SSDs and smartphones, the situation is often considerably more difficult due to TRIM, flash memory management, and encryption.

A reliable investigation result must therefore distinguish between data that has actually been recovered and mere technical possibilities.

13. Emails and communication can be analyzed.

In many cases, communication data is of particular interest. Depending on the data source, emails, messages, attachments, contacts, or other communication information can be examined.

Header information can be relevant in emails. It can contain clues about the mail servers involved and the technical transmission paths. However, the interpretation of such data must be done correctly because individual header fields can be manipulated.

The analyzability of messenger data depends heavily on the specific application, the device, the database structure, encryption, and the available backups.

14. External storage devices are examined.

In cases of suspected data leakage, examining external storage media can play a crucial role. Operating systems can store information about previously connected USB drives, hard drives, or other devices.

Under certain conditions, manufacturer information, device identifiers, or timestamps may be present. Whether a specific copying process can be proven beyond that depends on further artifacts.

The mere proof of a connected data carrier is therefore not equivalent to proof of a data leak.

15. Cloud services may be part of the investigation.

Modern workflows increasingly shift data to cloud services. Therefore, OneDrive, Google Drive, Dropbox, iCloud, or other platforms can also be relevant for a forensic investigation.

Depending on the system, local synchronization traces, browser information, application data, or directly accessible cloud data can be examined.

However, the mere fact that technical access is possible does not automatically mean that an evaluation is legally permissible. Access rights, data protection, and the scope of the investigation must be considered separately.

16. Additional traces are investigated in cases of cyberattacks.

Following a cyberattack, the investigation can become significantly more complex. In addition to end devices, servers, firewalls, network components, email systems, and other infrastructure may be affected.

The following can be investigated, among other things: login events, suspicious processes, malware, changes to files, network connections, or indications of a possible data leak.

In such cases, digital forensics and incident response overlap. The immediate containment of the incident must be coordinated with the securing of potential evidence.

17. The results are correlated with each other.

A particularly important step is the integration of different findings. Individual digital traces often have limited significance. In contrast, several independent data sources can combine to create a significantly more reliable picture.

An example would be a combination of USB artifacts, file accesses, user logins, and other system information. Only through this correlation can a technical process become comprehensibly condensed.

Alternative explanations must also be examined. Good forensics doesn't just look for data that confirms an existing hypothesis.

18. Findings and interpretation are separated.

The distinction between technical findings and expert assessment is crucial for a forensic investigation.

A finding might, for example, state that a specific USB device was registered on the examined computer. The evaluation can then examine the significance of this finding for the specific question being addressed.

The further statement that certain files were copied to this device may only be made if additional technical evidence is available to support this.

A thorough investigation therefore first describes what was found, and only then what conclusion can be drawn from it.

19. Exculpatory findings are also taken into account.

A forensic investigation must be open-ended. It must not solely seek evidence to support a pre-existing suspicion.

If technical data contradicts the assumed sequence of events, these findings must also be taken into account. The same applies to contradictory or ambiguous evidence.

The investigator's task is to evaluate the available data, not to produce a desired result.

20. The reliability of the data is assessed.

Not every digital trace has the same evidentiary value. Some artifacts document a technical process relatively clearly, while others allow only limited conclusions.

A login, for example, can show that a user account was used. However, this does not automatically imply which individual was actually sitting in front of the computer.

An IP address can document a technical connection or routing path, but it does not automatically constitute secure proof of identity.

The quality of a forensic assessment is therefore also demonstrated by the fact that the limitations of the respective data source are explicitly stated.

21. The investigation will be documented.

Comprehensible documentation is one of the most important components of a professional forensic investigation. It should clearly show which devices and data were examined and on what basis the key findings were made.

This may include information on the evidence, securing procedures, hash values, tools used, relevant work steps and key findings.

The more important a finding is for the investigation, the more precisely it should be traceable from which data source it originates.

22. An investigation report or expert opinion will be prepared.

At the end of the investigation, the results can be summarized in a technical report or expert opinion. The scope depends on the project requirements and the intended use.

An investigation report typically documents procedures, data sources, and results. An expert opinion goes further and answers a specific question through a professional evaluation of the findings.

It is important that technical findings, conclusions, and existing limitations are clearly separated.

23. The chain of evidence is kept traceable.

In investigations relevant to evidence, not only the technical analysis is important. The handling of the evidence must also be comprehensible.

The so-called Chain of Custody documents when and by whom a device was taken over, how it was secured, who had access to it, and what data basis was examined.

This makes it easier to understand later whether the analyzed data can actually be attributed to the originally acquired piece of evidence.

24. The results are checked for technical limitations.

Before an investigation is completed, it should be critically examined which statements are actually supported by the available data.

Missing data does not automatically prove that an event did not occur. Likewise, a single artifact can rarely document all the details of an event.

Encryption, missing logs, deleted data, damaged data carriers or incomplete backups can limit the reliability of the information.

These limitations should be part of the outcome.

25. The evidence will be securely stored after the investigation.

Once the analysis is complete, it should be determined how original devices, forensic backups, and working copies will be stored. The long-term integrity of the data can be particularly important in ongoing legal disputes.

Access control, encryption, secure storage systems and traceable transfers play an important role in this.

Originals should not be unnecessarily altered or used for everyday tasks as long as they may still be needed as evidence.

How long does a forensic investigation take?

The duration cannot be determined in general terms. A single small data carrier with a clearly defined question can require considerably less effort than multiple computers, smartphones, cloud accounts, and large data sets.

The technical backup process itself can also be time-consuming. With large storage media, significant amounts of data must be read, transferred, and then processed.

The actual analysis time also depends on how complex the question is and how many relevant artifacts need to be manually evaluated.

What influences the effort required for an investigation?

• Number of devices to be examined
• Storage size and data volume
• Type of operating system
• Encryption and access situation
• Data carrier status
• Scope of deleted data
• Number of relevant user accounts
• Cloud and network data
• Complexity of the issue
• Scope of required documentation
• Number of data sources to be correlated
• required special technical procedures

What can go wrong during a forensic investigation?

Errors often occur even before the actual analysis. If a device continues to be used unnecessarily, relevant data can be altered or overwritten. Installing programs, opening files, or cleaning systems creates new technical traces.

Another risk lies in premature interpretation. Those who assume a certain process has occurred before the investigation even begins may be inclined to consider only those artifacts that fit the analysis.

Even an uncritical acceptance of automatically generated results from forensic software can lead to incorrect conclusions.

Why is a structured investigation important?

Digital forensics is not a single software function. Quality arises from a controlled overall process.

A professional investigation combines the securing of the source material with comprehensible analysis, technical evaluation and complete documentation.

The more complex a situation is, the more important the methodological separation between verification, analysis, and interpretation becomes.

Frequently asked questions about the process of a forensic investigation

Is the original examined first?

Where technically feasible, a suitable forensic backup is created first, and work is then carried out based on this backup. However, with smartphones, live systems, and certain other data sources, direct access to the original may be technically necessary.

Does the computer need to be switched off?

Not necessarily. A different backup strategy might be more appropriate for a powered-off computer than for a running, already decrypted system. Carelessly shutting down a system can lead to the loss of volatile data or decryption states. The decision depends on the specific circumstances.

Can an examination change the device?

With traditional storage media, write access can be largely prevented under suitable conditions. With smartphones and running systems, technically induced changes are not always completely avoidable. The crucial point is to limit and document these changes.

Are all data considered during an investigation?

Not necessarily. A professional investigation should be guided by the specific question being asked. Especially with large datasets and personal information, a targeted investigation is often more useful than an undifferentiated, comprehensive analysis.

Can an investigation recover deleted data?

Under certain conditions, deleted data can be recovered. However, there is no guarantee. The storage medium, file system, encryption, and further use of the device are crucial factors.

Can a forensic investigation definitively establish who did what?

Not always. Technical traces can often be linked to a device, user account, or system event. However, definitively linking them to a specific individual may require additional evidence.

What happens after the investigation is completed?

The relevant findings are documented and summarized in an investigation report or expert opinion, depending on the assignment. Subsequently, arrangements should be made for the further storage or return of original equipment and forensic evidence.

A forensic investigation is a verifiable process.

A professional digital investigation consists of more than just reading data from a device or running an analysis program. It begins with a clear question being asked and the controlled backup of relevant data.

This is followed by technical analysis, correlation of various data sources, and a careful evaluation of the traces found. Only when it is comprehensibly documented how a finding was made and what its limitations are, does a digital result acquire its true significance.

The most important principle is therefore: First secure, then analyze, and only then evaluate.