Data acquisition (retrieval of information from IT media, con chain of custody):

In this activity, the acquisition process of the evidence is carried out and it is carried out with the devices that allow the intact preservation of original information.

Duplication of Digital Images: Through the use of hardware and software, a bit-by-bit copy of the information is made on hard drives.

This process is carried out attached to a chain of custody.

Data analysis and recovery of digital evidence:  In this activity, data analysis is carried out and through the search for certain information patterns evidence detection is performed.

Detection of anomalies in electronic data (detection of malware or malicious code).

Deletion or wipeo services (low-level or secure level deletion):

When organizations need to delete or reassign a computer to another user, it is recommended to perform this type of deletion before starting a new configuration.