What is the difference between acquisition and examination?¶

You have received a device export, forensic image, cloud return or other digital capture. Before anyone starts looking through it, be clear about the distinction between acquisition and examination.

Evidential caution: that once data has been copied, the evidence has already been examined. Acquisition only obtains the material. It does not establish what is relevant, what is missing, how records relate to one another or what conclusions can properly be drawn.

What this means¶

Examination is the process of locating, recovering, organising and presenting material within that acquisition. It may involve identifying files, messages, account records, deleted data, system artefacts, timelines or relationships between sources. Examination can reveal that an acquisition was incomplete, that timestamps require interpretation, or that a record exists in more than one form.

Analysis comes after or alongside examination. It asks what the recovered material means in the context of the investigation. A login record may show that an account session occurred, but analysis is required before linking it to a person. A message may exist in an extraction, but its sender, status, time and surrounding conversation may need careful interpretation.

Evidential limits¶

Acquisition is the controlled process of collecting digital material from a source. That source might be a phone, computer, online account, provider, network system or removable device. The acquisition method should record what was collected, the scope, the date and time, the tool or process used, any errors, and known limitations. It may produce a forensic image, logical extraction, native export, provider disclosure or live capture.

For a first responder, this distinction prevents accidental overreach. Opening files, scrolling through applications or using an account because access is available may amount to examination and may alter evidence. The fact that information is visible does not mean it should be explored without authority, purpose or a controlled method.