User
Acquisition
Password cracking
To verify data integrity
Overabundance of evidence
To identify key events and their chronology
Reporting
RAM
To ensure evidence is admissible in court
Data encryption
Analyze and interpret digital evidence