The examination of acquired data for its significance and probative value to the case.
NIST SP 800-101 Rev. 1
NIST SP 800-72
The third phase of the computer and network forensic process, which involves using legally justifiable methods and techniques, to derive useful information that addresses the questions that were the impetus for performing the collection and examination.
NIST SP 800-86