A data search method for computer forensic investigation comprising: inputting at least one pre-determined search term; searching a computer or digital device that is powered on in a forensically sound state for data matching one or more of the pre-determined search terms to identify target data from any of file names; strings; hash values or hash functions; installed programs; MAC and IP addresses; and/or metadata; and categorising the target data according to a pre-determined list of categories, wherein the categories are different to the search term/s and; wherein the data search method simultaneously searches for target data and categories the target data.