Evidence sources
Devices, accounts, cloud data, communications, logs and structured datasets relevant to an agreed question.
Forensic deliverables
- Evidence strategy and source map
- Preservation and acquisition plan
- Scoped examination and artefact recovery
- Timeline and relationship analysis
- Technical report or evidential briefing
Evidence handling
The intended use determines the acquisition, continuity, documentation and reporting required. Work is agreed before examination begins and limitations are recorded.