When an investigator submits digital devices to the forensic lab for processing, the request may be accompanied by time and date ranges, keywords, or other ways to help narrow down the amount of data needing to be processed. Other times, the entire device needs to be imaged.
