The five steps of examining the digital evidence start with the policy and procedure finding, and then comes evidence assessment followed by its acquisition, and examination. And the final step is documentation and reporting. And as far as the keyword searches and file carving utilities are concerned to locate data, this is done during evidence assessment, and once keywords and file carving utilities are assessed, the final set of evidence is required in the next step. And hence the correct stage which deals with the keyword searches and the file carving utilities for locating the data is the evidence assessment.
