The Importance Of Objectivity In Digital Investigations

Is Your iPhone Leaving Digital Footprints?
August 1, 2012
Prudential Associates Featured in Bethesda Magazine
August 15, 2012
Show all

The Importance Of Objectivity In Digital Investigations

If you think that an examiner’s responsibilities include merely making an analysis of the evidence that is provided to them, then you’d only be half right.  The truth is that while they are required to perform a thorough analysis of the evidence provided by an investigator, there is always the possibility that there is more to the data than initially meets the eye, so an objective, thorough review is a “must” for any good investigation.

Remaining Objective & Thorough

Generally speaking, examiners are asked only to investigate the facts in such a way that the outcome will remain unbiased.  We all know that remaining neutral can be difficult, and it is fair to say that given the individuality of each examiner, that some form of bias might eventually sway his or her findings?

Let’s take a hypothetical scenario where child pornography is found on someone’s personal computer.  If we read about this in the paper, you and I might conclude that the evidence is black and white, right?

Well as far as the examiner is concerned, the evidence is clear, but is that the end of the line?  Additional context is required, and good questions to consider might be:

  • Was all of the physical evidence in this case taken into account?
  • Yes, child pornography was found on the computer, but has the source of the illicit material been determined?
  • Would a more thorough analysis and investigation conclude that the pictures were a spam message sent to the subject, or downloaded through a malicious virus or proxy?

We Collect the Facts – Let the Courts Decide

Although the accused would seem to be guilty based on “facts” such as having the files on their computer, is it not beyond the realm of possibility that they are actually the victim in this scenario?  The better outcome would be to present all of the evidence in front of a court of law where a determination would be made as to the innocence of guilt of the subject.

We need to bear in mind that the examiner is not only responsible for a surface level evaluation of the evidence, but that they should also be providing important, substantial information regarding the source of the evidence and the trail that led to the evidence being discovered, regardless of by what means.

At Prudential Associates, we believe that our own personal prejudice needs to be set aside to ensure that the end result of the investigation is unmarred by personal feelings on the subject, or the crimes that the suspect is accused of.  It is only then that we will have a clear, concise picture of exactly what has taken place and be able to render a verdict that is truly just.  You can also learn more about our computer forensic services by clicking here.