Authors: Brian Carrier, Ph.D. (@stake)
DFRWS USA 2002
The high-level process of digital forensics includes the acquisition of data from a source, analysis of the data and extraction of evidence, and preservation and presentation of the evidence. Previous work has been dnoe on the theory and requirements of acquisition  and the presevation of evidence. This paper addresses the theory and requirements of analysis and extracction of evidence from the acquired data.