[t]he examination of acquired data for its significance and probative value to the case.
[t]he process by which information is examined in order to identify significant facts and/or derive conclusions.
[t]he third phase of the computer and networkforensic process, which involves using legally justifiable methods and techniques, to derive useful information that addresses the questions that were the impetus for performing the collection and examination.
(1) Study and examination of something complex by separating it into more simple component. Typically, includes discovering the parts of the thing being studied, how they fit together, and why they are arranged in a particular way. (2) Study of variances for cause, impact, corrective action, and results.
"Analysis is always done by a human. Analysis requires using thought processes by which collected information is evaluated and integrated with existing information that requires taking multiple pieces of information, thinking through their related connections, and determining a particular conclusion. Computers can assist in analysis, but do not conduct analysis."