From the digital forensics definition, the digital forensic investigation process involves several stages and steps to handle and manage the digital evidence that can be extracted from the crime scene as follows Figure :
Identification: This process involves the identification of an incident and the evidence thereof, which will be required to prove the incident.
Collection: In this process, an examiner and a digital investigator collect digital evidence from the crime scene.
Extraction: In this phase, a digital investigator extracts digital evidence from different types of media, for example, hard disk, cell phone, e-mail, and much more.
Analysis: In this phase, a digital investigator interprets and correlates the available data to arrive at a conclusion, which can prove or disprove an incident.
Examination: In this phase, an investigator extracts and inspects the data and their characteristics.
Presentation: In this process, a digital investigator makes an organized report stating his or her findings of the incident which have to be appropriate enough to present to the jury.