Which of the following is a correct listing of some stages in the standard digital forensics process model?

• A. Preservation, Identification, Collection, Examination, Analysis, Documentation, Presentation, and Review
• B. Identification, Collection, Analysis
• C. Preservation, Collection, Examination, and Analysis
• D. Documentation, Presentation, Review

Answer: (A)

The standard digital forensics process model includes stages that ensure evidence is handled properly from discovery to presentation. Preservation protects data from alteration; Identification determines what sources may yield relevant artifacts; Collection securely acquires those artifacts; Examination is the hands-on inspection and extraction of evidence; Analysis interprets the artifacts to build a case or answer the question at hand; Documentation records what was done, including procedures and chain of custody; Presentation communicates the findings clearly to stakeholders; Review checks the work for completeness and compliance with procedures. This set covers all essential steps, which is why it is the best choice. The other options omit one or more essential stages—for instance, they include only a subset of steps or miss Preservation or Documentation or Presentation—so they do not represent the full standard process.