A digital investigation process model

Goal: To develop a model for the digital investigation process, so that requirements can be developed for forensic analysis tools and procedures. Summary: The procedures for a physical crime scene are applied to the digital crime scene. Deployment: Detect a crime or incident, verify it, and obtain authorization to respond or investigate. Preservation: Secure the physical area around the digital device. Survey: Cursory search of the physical crime scene for obvious pieces of evidence about the incident. Documentation: Take pictures and sketches of physical evidence. Search: Conduct a thorough search of the physical crime scene for evidence. Digital investigation begins when digital devices are collected. Reconstruction: Reconstruct the physical and digital events that occurred at the crime scene.