This paper walks through a simulated criminal investigation, examining a suspect’s laptop and phone for evidence of an illegal transfer of classified information. I used forensic tools to create an unaltered copy of the laptop’s data, extract messages and files from the phone, and recover deleted files, then compiled the findings into a formal report.