Investigator handling forensic data recovery process