The data identification phase is an iterative process of locating sources of information about potentially relevant data. Part art and part science, data identification requires making use of available sources of information. Data identification first establishes the full set of data sources, who owns those data sources, and what the data sources contain. From there, an investigator can home in on exactly what information is available in each data source and determine what information from each data source needs to be collected. Big Data systems are voluminous and collecting petabytes of data is rarely a viable option, so an investigator needs to exert caution when determining what data to collect. However, that caution has to be tempered with the need to completely collect relevant data the first time because that data may not be available after the collection process is finished.

The next two chapters explain how to collect the forensic evidence identified by the steps in this chapter...