The 9 phases of digital forensics, with tools and a worked example

Key takeaways

• Nine phases: first response, search and seizure, collection, securing, acquisition, analysis, assessment, reporting, testimony.
• Work on a forensic copy, never the original, and prove it with a hash.
• Chain of custody records who held the evidence and when.
• The nine-phase model comes from EC-Council's CHFI curriculum; NIST uses four phases: collect, examine, analyse, report.
• Documentation matters as much as technical skill.

What are the nine phases of digital forensics?

They are the stages of a forensic investigation from the first alert to the courtroom. Different bodies group the work differently. The nine-phase breakdown below is the one used in EC-Council's CHFI curriculum. NIST describes a four-phase process (collection, examination, analysis, reporting) in SP 800-86. The work is the same. Only the grouping differs.

Phase 1: first response

The responder stops the damage without destroying evidence. That means isolating a machine from the network, but usually not powering it off, since memory holds useful data. Write down the time, what you saw and what you did.

Phase 2: search and seizure

Devices may be taken only with proper authority: a warrant for law enforcement, or written authorisation from the organisation for a corporate case. Photograph devices as found, label everything, and use anti-static bags. In India, procedures for electronic evidence are set by law, and the rules changed when the Bharatiya Sakshya Adhiniyam, 2023 replaced the Indian Evidence Act. Check current requirements with legal counsel.

Phase 3: evidence collection

Collect volatile data first (memory, running processes, network connections), because it vanishes on shutdown. Then collect disks, logs and cloud exports. Always record the order you used.

Phase 4: securing the evidence

Evidence needs a chain of custody: a log of who handled each item, when, and why. A gap in that log is the easiest way for the other side to challenge evidence.

Phase 5: data acquisition

You never analyse the original disk. You make an exact copy and analyse that. A write blocker stops the examining machine from changing the source. Here is a lab example using a practice USB stick or a disk image you own. Replace the device name carefully.

$ lsblk
$ sudo dd if=/dev/sdb of=case001.img bs=4M status=progress conv=noerror, sync
$ sha256sum /dev/sdb case001.img

If the two hashes match, the image is an exact copy. Record the hash in your case notes. Hashing the source device before and after proves nothing changed.

Phase 6: data analysis

Open the image in a tool such as Autopsy and look at the file system, deleted files, browser history, registry hives and timestamps. Memory images go to Volatility. Network captures go to Wireshark. Browser history is often the first artefact to check.

Phase 7: evidence assessment

Not everything you find is relevant. Here you decide which artefacts connect to the incident and how strongly. A timeline helps: line up logins, file changes and network events in one view.

Phase 8: documentation and reporting

Write what you did, with enough detail for another examiner to repeat it. Include tool names and versions, hash values, timestamps and screenshots. State facts and keep opinions separate.

Phase 9: expert testimony

A forensic examiner may have to explain the work to a judge or a board with no technical background. Plain words and a clear report matter. Stay inside what the evidence supports.

Common mistakes

• Analysing the original instead of an image.
• Powering off a live system too early and losing memory evidence.
• Missing hashes or a gap in the chain of custody.
• Mixing observations with conclusions in the report.

For the wider picture see what digital forensics is.

Next steps

To learn the tools in a lab, look at the CHFI course. For the broader subject read mastering digital forensics.

Related reading

• How Digital Forensics Enhances Cybersecurity? Investigations, Recoveries, and Legal Compliance
• Digital Forensics: The Backbone of Cybersecurity