Steps for Investigation

The incident occurred in any company or organization.
The employees or members contact the company's advocate for legal advice.
Advocate contact cyber forensics investigator (external or internal).
The forensics investigator will come and prepare the FRP, i.e., First Response Procedure documentation.
The investigator then seizes the evidence and other assets related to the crime scene and transports them to a forensics lab.
He/she will start analyzing the files and other assets.
Examine all the data one after another and may further contact the person or group of people associated with the incident.
The report will be formed and concludes the investigation, where all the analysis will be written and explained.
The report is then handled to the organization's legal authorities.
The legal authority will then go through the report(s) and will press charges against the offensive in the court of law.
The forensics investigator will delete all the data once the entire case is closed.