1. Examining and analyzing digital evidence will depend on the nature of the investigation and the amount of data to process. Criminal investigations are limited to finding data defined in a search warrant and civil investigations are often limited by court orders for discovery. Suppose that you are the investigator on a case involving a burglary where it is believed the there are two suspects that sent information to each other via computer. What information would you request in a warrant so that you have the ability to examine both computers?
2. What are the basic steps one should follow for all digital forensics' investigations?
3. Why is it important to refine investigation plan in private sector cases?