According to NIST, which step in the digital forensics process involves preparing and presenting information that resulted from scrutinizing data?

NIST describes the digital forensics process as involving the following four steps:

• Collection – the identification of potential sources of forensic data and acquisition, handling, and storage of that data
• Examination – assessing and extracting relevant information from the collected data. This may involve decompression or decryption of the data
• Analysis – drawing conclusions from the data. Salient features, such as people, places, times, events, and so on should be documented
• Reporting – preparing and presenting information that resulted from the analysis. Reporting should be impartial and alternative explanations should be offered if appropriate