Department of Defense Cyber Crime Center Digital Forensic Examiner Kenneth Malin prepares to examine data in the DC3 Cyber Forensic Lab. There are seven common phases of a digital forensic investigation workflow: preparation, identification, collection, preservation, examination, analysis and presentation. (Photo by Stephen Murphy, DC3/PA)