Which stage directly follows Examination in the standard digital forensics process model?

• A. Preservation
• B. Identification
• C. Analysis
• D. Presentation

Answer: (C)

The main idea here is how the evidence is turned into information. During Examination, you inspect the data, recover artifacts, and verify integrity in a forensically sound way to understand exactly what exists on the evidence. Once that thorough inspection is done, you move into Analysis, where you interpret the artifacts, reconstruct events, establish timelines, and determine what the findings mean in the case. This step uses the results of Examination to draw conclusions, connect clues from different sources, and assess significance. Preservation and Identification happen earlier to protect and scope the evidence, while Presentation comes later to report the findings and conclusions.