What is the difference between acquisition and examination?¶

Acquisition collects digital material from a defined source. Examination works within that collected material to locate, recover and organise potentially relevant records. Receiving a copy does not mean its contents have already been examined or interpreted.

Acquisition defines the material available¶

An acquisition might be a storage image, logical device extraction, native account export, provider disclosure or live capture. Its record should identify the source, scope, date, method, operator, errors and known limitations.

Those choices affect what examination can find. A logical phone extraction may omit deleted or inaccessible data. A provider return may cover only a stated date range. A native export may retain relationships that a PDF rendering loses.

Examination reveals records and limitations¶

Examination identifies files, messages, accounts, system artefacts, timelines and relationships within the acquisition. It may recover deleted material, expose duplicate representations or show that the collection was incomplete.

Analysis then considers what those findings mean. A login record can show an account event without identifying the human responsible. A message may require its status, time, sender fields and conversation context to be interpreted before a conclusion is safe.

This boundary matters during first response. Opening files or scrolling through an accessible account may amount to examination of a live source and may alter it. Visibility does not by itself supply authority, purpose or a controlled method. Preserve and acquire first unless a separately justified urgent action requires otherwise.