Troubleshooting when processes fail

Since investigative and judicial processes are put together by humans, from time to time they fail; sometimes quite spectacularly. In this section, we will look at a couple of common examples and discuss what to do when situations like these arise.

Soundness of evidence

One of the most frequent criticisms levelled at digital forensic investigators comes in the form of a challenge to the soundness of the evidence they are presenting. This includes the common It wasn't me defense, wherein a defendant insists that they were not the one using the device in question; the suggestion that the evidence itself is somehow faulty; either because of a virus or malware having infected a device before it was analysed, or because the process of analysis itself has modified the data in some way.

There are a couple of ways to deal with these concerns, so lets take a look at them one by one.

It wasn't me

One of the most difficult challenges to deal with in digital forensic investigations...