Phases of a Digital Evidence Investigation

Why This Topic Matters
Almost every modern fraud leaves a digital footprint: emails, spreadsheets, accounting system logs, text messages, browser histories, cloud files, and mobile device data. For the Certified Fraud Examiner, digital evidence is often the most persuasive proof of intent, concealment, and collusion. However, digital evidence is also the easiest evidence to destroy, alter, or render inadmissible. A single careless act, such as switching on a seized laptop or opening a file on the original hard drive, can change metadata, overwrite deleted data, and give opposing counsel grounds to challenge the entire investigation.

The ACFE therefore teaches digital forensics as a structured, phased process. Understanding the phases of a digital evidence investigation helps you (1) protect the integrity and admissibility of evidence, (2) know when to call in a qualified digital forensic specialist, (3) maintain a defensible chain of custody, and (4) answer the recurring exam questions in the Investigation section that test the order of the phases and the activities that belong to each one.

What a Digital Evidence Investigation Is
A digital forensic investigation (also called a computer forensic investigation) is the application of scientifically sound and legally defensible methods to identify, seize, preserve, analyze, and report on data stored in or transmitted by electronic devices. The goal is to recover and interpret digital information in a way that preserves its evidentiary value so that it can be relied upon in administrative, civil, or criminal proceedings.

The Fraud Examiners Manual emphasizes several foundational principles that run through every phase:
• Digital evidence is fragile and volatile. Data in RAM disappears when power is lost; deleted files can be overwritten simply by using the computer; timestamps change when files are opened.
• Only trained personnel should handle, image, or examine digital media. A fraud examiner without forensic training should secure the device and call a specialist rather than attempt to look through files.
• Never work on the original. All examination is performed on a verified forensic copy (image).
• Document everything. Every action taken on the evidence, from the moment of seizure through reporting, must be recorded so the process is repeatable and the chain of custody is unbroken.
• Legal authority must exist before anything is seized. This may come from a search warrant, a court order, written consent, or an employer's clearly communicated policy over company-owned devices. Privacy and data protection laws must be respected.

How It Works: The Phases
Different frameworks describe the process in slightly different numbers of steps, but the ACFE material generally presents a digital forensic investigation as moving through the following phases in order: Planning and Preparation, Identification, Seizure and Collection, Preservation and Imaging (Acquisition), Analysis and Examination, and Reporting. Some texts compress these into four phases: seizure, imaging, analysis, and reporting. For exam purposes, know both the full sequence and the activities tied to each phase.

Phase 1: Planning and Preparation
Before any device is touched, the examiner plans. Key activities include:
• Defining the objectives and scope of the investigation (what is the allegation, what information is needed, what time period is relevant).
• Confirming legal authority to search and seize (warrant, consent, corporate policy, court order) and identifying any privacy, labor, or jurisdictional restrictions.
• Identifying the likely sources of digital evidence: desktops, laptops, servers, mobile phones, tablets, removable media (USB drives, external hard drives), network devices, cloud storage, backup tapes, email servers, and application logs.
• Assembling the team, including a qualified digital forensic examiner and legal counsel, and clarifying roles so that untrained staff do not handle evidence.
• Preparing the tools and supplies: write blockers, forensic imaging hardware and software, evidence bags, Faraday bags for wireless devices, labels, cameras, and chain-of-custody forms.
• Determining timing (for example, conducting the seizure after hours or simultaneously at multiple locations to prevent tip-offs and destruction of evidence).

Phase 2: Identification
Upon arriving at the scene or beginning the engagement, the team identifies what evidence actually exists and is relevant. This involves surveying the physical location, noting all devices present (including hidden or disconnected media), identifying network connections and whether systems are powered on, and determining which devices fall within the scope of legal authority. The examiner also documents the scene through photographs, video, and sketches, capturing screen contents, cable connections, and the position of equipment before anything is moved.

Phase 3: Seizure and Collection
This is the physical taking of control over the devices and media. Critical rules include:
• Secure the scene and keep the subject and other employees away from devices so they cannot delete data or issue remote wipe commands.
• If a computer is off, leave it off. Powering it on alters data.
• If a computer is on, a trained examiner decides whether to capture volatile data (RAM, running processes, network connections, encryption keys) before shutdown, and whether to perform a controlled shutdown or pull the power plug. Pulling the plug is often preferred for workstations to avoid destructive shutdown scripts, while servers may require a controlled shutdown to avoid data corruption.
• Isolate mobile devices from networks (airplane mode or Faraday bags) to prevent remote wiping or incoming data that overwrites evidence.
• Label and document every item: make, model, serial number, condition, location found, and who collected it. Photograph all connections before disconnecting cables.
• Collect supporting items: passwords written on notes, manuals, software disks, printouts, and removable media found nearby.
• Start the chain of custody immediately, recording every transfer of possession from this point forward.
• Package items properly, using anti-static bags and avoiding exposure to magnets, heat, and moisture.

Phase 4: Preservation and Imaging (Acquisition)
Preservation ensures the evidence remains unchanged. The core activity is creating a forensic image, which is a bit-by-bit (bit-stream) copy of the entire storage medium, including deleted files, slack space, and unallocated space, not just the visible files. Important points:
• A write blocker (hardware or software) is used so that nothing can be written to the original drive during imaging.
• A hash value (such as MD5, SHA-1, or SHA-256) is calculated for the original and the image. Matching hash values prove the copy is an exact duplicate and that the evidence has not been altered. Hashes are recalculated later to demonstrate continued integrity.
• Best practice is to make at least two images: one working copy for analysis and one preserved as a backup. The original device is then sealed and stored securely.
• All examination is performed on the image, never on the original.
• The imaging process, tools used, software versions, and hash values are fully documented.

Phase 5: Analysis and Examination
In this phase the forensic examiner searches the image for relevant evidence using specialized tools (such as EnCase, FTK, X-Ways, or Autopsy). Typical analysis tasks include:
• Recovering deleted, hidden, encrypted, or password-protected files.
• Examining unallocated space and file slack for remnants of deleted data.
• Reviewing file system metadata (creation, modification, and access dates) to build timelines.
• Analyzing email, chat logs, internet browsing history, downloads, and cloud synchronization records.
• Reviewing the operating system registry, recently used file lists, USB device history, and printing records to show user activity.
• Keyword searching, hash-set comparison to identify known files, and filtering out irrelevant system files.
• Detecting anti-forensic techniques such as wiping utilities, steganography, or timestamp manipulation.
The examiner follows a repeatable methodology and documents each step so another qualified examiner could reproduce the results. Findings are interpreted objectively, including evidence that might be exculpatory.

Phase 6: Reporting
The final phase communicates the findings. A digital forensic report should:
• Describe the scope, the legal authority, the items examined, and the chain of custody.
• Explain the methodology and tools used, including hash verification.
• Present the findings clearly, factually, and without speculation, in language understandable to non-technical readers such as managers, attorneys, judges, and jurors.
• Include supporting exhibits, screenshots, and timelines.
• Be prepared with the expectation that the examiner may have to testify and defend every step in court.

Common Pitfalls the Exam Likes to Test
• Letting an untrained employee or IT staff member browse the suspect's computer to see what is there (alters evidence, breaks chain of custody).
• Turning on a powered-off device or shutting down a device without considering volatile data.
• Examining the original media instead of a forensic image.
• Failing to use a write blocker or failing to verify the image with a hash value.
• Seizing devices without proper legal authority or in violation of privacy rights.
• Leaving mobile devices connected to a network, allowing remote wiping.
• Incomplete documentation of the scene or gaps in the chain of custody.

Exam Tips: Answering Questions on Phases of a Digital Evidence Investigation
1. Know the sequence cold. Questions often ask which phase comes first or what happens immediately after seizure. Remember the logical flow: plan, identify, seize, image (preserve), analyze, report. Planning always comes before any device is touched; imaging always comes before analysis; reporting is last.

2. Match activities to phases. Expect scenario questions such as 'An examiner calculates a hash value of a hard drive copy. In which phase is this performed?' Hashing, write blocking, and bit-stream copying belong to preservation/imaging. Photographing the scene, bagging devices, and starting the chain-of-custody form belong to seizure. Keyword searching, recovering deleted files, and building timelines belong to analysis.

3. The 'never work on the original' rule is a favorite. Any answer choice that involves examining, opening, or searching files on the original seized device is almost always wrong. The correct answer will involve working on a verified forensic image.

4. Untrained personnel should not examine digital evidence. If a question describes a fraud examiner, manager, or IT administrator who finds a suspect computer, the best answer is to secure the device, prevent access, document the scene, and contact a qualified digital forensic specialist, not to start reviewing files.

5. Powered-off devices stay off. If the scenario says the computer is off, do not turn it on. If it is on, the decision about volatile data capture and shutdown method belongs to a trained examiner; the exam may test that pulling the plug on a workstation is acceptable to avoid destructive scripts, while servers generally need a controlled shutdown.

6. Hash values prove integrity, not identity. Understand that a hash is a digital fingerprint used to show the image is identical to the original and has not been altered. If the hash changes, the evidence has been modified. Do not confuse hashing with encryption.

7. Chain of custody begins at seizure and never ends. Questions may describe a gap, such as a drive left unattended on a desk overnight. Recognize this as a chain-of-custody failure that threatens admissibility.

8. Legal authority precedes seizure. If an answer choice involves seizing personal devices or searching data without a warrant, consent, or applicable policy, it is likely incorrect. Employer-owned devices with a clear policy are generally searchable; personal devices typically are not without consent or legal process.

9. Watch for 'best' and 'first' wording. When asked for the first step upon discovering evidence, the answer is usually to secure and document rather than to collect or analyze. When asked for the best practice, choose the option that preserves evidence integrity and involves qualified experts.

10. Reporting must be objective and understandable. Answer choices suggesting the report should be highly technical, omit methodology, or state conclusions about guilt are wrong. The report documents methods, findings, and chain of custody in plain language and supports possible testimony.

Quick Review Summary
• Plan: objectives, scope, legal authority, team, tools, sources of evidence.
• Identify: survey and document the scene, determine relevant devices.
• Seize: secure the scene, isolate devices, photograph, label, bag, begin chain of custody, leave powered-off devices off.
• Preserve/Image: write blocker, bit-stream copy, hash verification, two copies, secure the original.
• Analyze: work only on the image, recover and interpret data, document repeatable methods.
• Report: clear, objective, complete, courtroom-ready.

Master the order, the key activity in each phase, and the integrity rules (trained examiners only, never the original, write blockers, hash values, chain of custody), and you will be well prepared for any Phases of a Digital Evidence Investigation question on the CFE Exam.