Which stage of the standard digital forensics process involves documenting the results and preparing a final report?

• A. Documentation
• B. Review
• C. Presentation
• D. Preservation

Answer: (C)

The stage that focuses on communicating the findings and delivering the final deliverable is the presentation phase. In this phase, the investigation’s results are organized into a clear narrative, supported by the evidence and the methods used, and a final report is prepared for the intended audience—whether investigators, legal teams, or a court. It’s about turning analysis into a concise, understandable presentation of conclusions and supporting exhibits, so others can review and act on them.

Documentation is the ongoing logging of how the case was conducted—steps taken, tools used, and chain of custody—while preservation aims to keep evidence intact and untampered. Review involves checking the accuracy and quality of work. While those steps feed into the final report, the act of composing the final report and presenting the findings aligns most closely with the presentation stage.