The process of returning electronic evidence to its true context when created, by whom, for what purpose, etc..”