a set of methodological procedures and techniques that help identify, gather, preserve, extract, interpret, document and present evidence from computing equipment, such that any discovered evidence is acceptable during a legal and/or administrative proceeding.