Forensic identification and collection are two primary investigation steps in the field of digital forensic investigation. The forensic identification process includes incident identification in terms of determining the crime incident and evidence identification in terms of finding the digital evidence against the malicious activity. In the digital forensic process, forensic collection involves acquiring the digital information relevant to the investigation from the suspected sources.
In digital forensics, identifying evidence sources is critical in the voluminous environment without compromising data privacy rather than further investigation processes. The different forensic research areas such as mobile, cloud, mobile cloud, network, Internet of Things (IoT), and database deals with various shortcomings in the identification and collection of the evidence from the suspected environment.
The acquisition of the phase of the evidential artifacts greatly assists the further investigation of the crime event without neglecting the artifacts extracted from the source of evidence. The physical and logical acquisition allows the forensic investigator to conduct a forensically sound investigation against the legal implications. Hence, extracting potential and reliable artifacts maximizes the admissibility of the evidence in a court of law.