Discuss general facts about a case to ensure there is a mutual fit between clients and d-evidence

Determine the approach to the case and approximate time to complete both preliminary and exhaustive examinations/investigations

Obtain details about the exact evidence requested—it may need to be recovered after suspect deletion

A description of additional resources required e.g.: unique hardware or software, experts

Obtain a forensic image (preserving original evidence) of the suspect’s drive(s) and media

Decrypt password protected files

Recover the evidence and analyze it

Validate the evidence with other tools

Complete a case report on the evidence

Submit and present the evidence for client questions on methods and process

Obtain client evaluation on performance of evidence reports