Answer:
Identification: find the evidence, noting where it is stored.
Preservation: isolate, secure, and preserve the data.
Analysis: reconstruct fragments of data and draw conclusions based on the evidence found.
Documentation: create a record of all the data to recreate the crime scene.
Presentation: summarize and draw a conclusion.