Order The order for collecting digital evidence on macOS and Linux-based systems during a forensic investigation is similar to that of Windows systems.