Start with the evidence or the question.
Find a sensible first step when digital material appears in your enquiry. Begin with what you have, then use the deeper explanation when you need it.
What have you been given?
An IP address or online connection
Work out what system recorded it, what can be preserved and which further records could help.
Start with an IP address →A suspicious email
Understand the message, preserve the original and identify useful records and enquiries.
Start with a suspicious email →A phone or an extraction report
Find guidance on device evidence and what forensic reports can and cannot establish.
Explore mobile extraction guidance →A payment or transaction
Identify the accounts, timings and records that can develop a financial enquiry.
Explore payment evidence →An account, login or username
Explore account activity, authentication and the records that may show what happened.
Explore account evidence →Something else
Browse the full reference library.
Browse the library →Want to learn the method?
Follow fictional investigations that let you inspect evidence, make judgements and get feedback.
Use sanitised or fictional examples when asking questions. Do not enter operational or personal data.
