Column: Analysis of Digital Traces

Abstract

In cases where the examiner also performed collection, the details of the collection process may also be known, and so forth. The examiner may also rely on statements, paperwork, claims, and all manner of other things to put the bag of bits into context, but at the start of the examination, anything outside of the personal knowledge of the examiner 2 should be treated as speculative and subject to refutation. Analysis is largely about performing computations on the bag of bits and related information to produce analytical products and derived traces. These products are then used to interpret, attribute, reconstruct, present, and otherwise work with the evidence to other examiners, lawyers, triers of fact, etc. But in order to do this, something about the bag of bits must support or refute hypotheses about what it contains.