Which phase focuses on identifying potential sources of relevant evidence, custodians, and data locations?

• A. Preservation
• B. Identification
• C. Collection
• D. Analysis

Answer: (B)

Identifying potential evidence sources, custodians, and data locations focuses on scoping what could be relevant for the case. This phase involves mapping where data might reside (emails, file servers, databases, endpoints, cloud services, logs, backups), who likely has control or knowledge of that data (custodians), and where to search (systems, locations, and data types). Establishing this scope early ensures you don’t miss critical sources and makes subsequent steps like preservation and collection targeted and efficient. Preservation comes next to safeguard what’s found, followed by collection to actually acquire the data, and finally analysis to examine and interpret the evidence.