Phases of an Investigation: Planning, Collection, Analysis and Reporting
The four stages of every investigation
Every well-executed technology investigation follows a sequence of four phases (planning, collection, analysis and reporting), and skipping or rushing any of them usually compromises the quality of the final result. Planning defines the scope, resources and initial hypotheses before touching any evidence, while collection focuses on capturing data while preserving its integrity and chain of custody. Analysis is where the collected evidence is cross-referenced to build the narrative of events, and the report translates those conclusions into a document useful to stakeholders. In practice, many novice investigators make the mistake of starting to analyze evidence before they've finished collecting it or clearly defined the scope, which forces them to repeat work when a new source appears that changes the picture. Respecting the order of the phases, even if they sometimes overlap slightly, keeps the investigation organized and defensible in any later review.