Digital forensics is the process of discovering and interpreting electronic data that can be used in a court of law. It requires a set of standards to show how the information collected, stored and analyzed is rigorously followed. Analysts need to understand the evolution of current technology and the impact it will have on how they gather information. The investigator is able to uncover evidence and analyze it to understand the motives, the crime, and the identity of the criminal to help solve it. As computers and technology continue to become part of our daily lives, the cyber realm contains a growing scope of evidence in all types of criminal investigations (Cummings, 2008). Digital forensics is a way to connect information security and law enforcement. It ensures that digital evidence is collected in such a way that it can arrive in courts unhindered or uncontaminated (Dlamini, M., Eloff, J. & Eloff, M., 2009). Digital forensics can be broken down into three phases; acquisition, analysis and presentation. The acquisition phase is where the data is saved so that it can be analyzed later. Since it is currently unknown which data is or is not useful for the case, all data is saved. In the analysis phase the data is examined and placed into three broad categories; inculpatory, exculpatory or signs of tampering with evidence (Carrier, 2002). At this stage, tools are used that can analyze the contents of the list directory, deleted files and recover deleted files. In the presentation phase, the data were documented so that they could be subjected to peer review. When deleted files are recovered, the analyst must show how they were found because they were... middle of paper... include smartphones, cell phones, iPods and MP3 devices. They get this distinction because they are small enough to hold in the hand (Bennett, 2011). The iPad does not fall into this category because it is considered more of a computer and less of a portable device. These devices are very popular, and many contain storage devices similar to a laptop. They are easily transportable and can run many applications that can be run on a regular computer (Bennett, 2011). The reason they are so vital to digital forensics is that they typically contain large amounts of personal and organizational information. They are also used because they are essentially portable data carriers (Bennett, 2011). Because of their ease of use and the type of data they contain, they have great potential for incriminating data and can be used as evidence in criminal cases (Bennett, 2011).