Pre-analysis steps

Several steps are performed before the analysis can be started. The data is first imported into the database. Some data is structured in a manner that cannot be imported and requires pre-load transformations. The data should be surveyed after the data has been loaded to understand the structure of the data, detect any anomalies, and determine which data require transformations. Based on the results of the data survey process, the data may require transformations before it can be analyzed.

This process can be iterative. The data may require a series of transformations, and after each transformation, a data survey needs to be performed to assess whether any further transformations are required. The following figure illustrates the steps and iterative nature of the pre-analysis process:

Figure 2: Transformed records

Loading data

The collected evidence is next loaded into SQL Server. Relational databases systems store data in databases comprised of tables. With forensic evidence...