At a high level, the Digital Forensic Expert copies, examines, and analyzes information, prepares a report, and substantiates findings in depositions and through expert testimony. The first step is to work with counsel to develop an appropriate strategy and determine the evidence needed to support the case. The next step is to collect and preserve the evidence. Finally, an analysis is performed on the collected data. Analysis may include keyword searches, timeline analysis, deleted file recovery, email analysis, and other tasks related to evidence identification and recovery. Then, conclusions are typically documented in a report, affidavit, or declaration. Conclusions are further supported in depositions, hearings, and at trial, when necessary.