Evidence preservation includes efforts to maintain evidence in it original, unaltered state. The use of write-blockers are often used to prevent the unintentional alteration of the original data. Data acquisition includes generating an exact copy of the data to be used in the processing and analysis phases. Where the collection of 'live' data is necessary and warranted, steps are taken to limit any unintentional alteration of the data while it is being acquired.

Data recovery and processing includes the use of recognized forensic software applications to recover and extract data from the exact copy of the evidence. Processing is also used to categorize data types (i.e. email, text messages, pictures, etc.) to assist and expedite the analysis phase. By categorizing the data, analysis can focus on the data types relevant to the investigation.

Reporting includes the summation of data analysis results where the analysis results become understandable to non-technical parties. Reporting can be performed in writing such as in an expert opinion report, or verbally such as sworn testimony.

Analysis is the process of reviewing categorized data types relevant to the investigation to identify useful information. The goal of data analysis is to identify useful information which can be used to make informed decisions.