Extracting evidence from digital devices such as handphones. It usually involves retrieving data from existing or deleted files, interpreting their meaning and putting them within the context of the investigation