Forming an investigative opinion in digital forensics

Abstract As we now see digital evidence play a role in many investigative scenarios, it is imperative that those seeking to rely upon it as part of criminal justice processes can do so, absent any concern regarding its validity. Interpreting the meaning of digital data and its potential value to a criminal inquiry as part of a digital forensic examination is a complex and multifaceted process requiring the practitioner to possess the relevant knowledge, experience, and insight needed to determine the case‐significance of a given data trace accurately. Erroneously interpreted data that is communicated to a client and subsequently relied upon can have far‐reaching consequences for all those involved in the investigative process. This work discusses the process of forming investigative opinions in digital forensic science examinations, what this means in practice, and the ways in which it can be achieved. Focus will be given to the process of forming an investigative opinion when underpinned through the reconstruction and testing of a suspect system/setup, with a formal three‐stage methodology for doing this outlined. This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation