AbstractIntroductionThe four phases of digital forensicsIt is a matter of questionsInvestigative questionsLegal questionsForensic questionsIdentificationClassification/individualizationAssociationReconstructionForensic questions as a bridgeDeveloping forensic hypothesesKnowing how far to goStarting the planHow do you know when you are done?Examination phase – data extractionThe forensic analysisThe examination planning processConclusion