The procedure comprises of three steps: acquisition, analysis, and reporting and is mostly utilised in computer and mobile forensic investigations.