An Empirical Investigation of the Evidence Recovery Process in Digital Forensics