Considering ‘technically possible’ alternative meanings for data traces found during a digital forensic examination

Abstract

As part of a digital forensic examination, a practitioner may identify data traces that they believe to be relevant to their inquiry and seek to interpret their meaning, forming a primary investigative hypothesis. In addition, practitioners should also consider whether any traces could mean something else. This work discusses the need for practitioners to consider ‘technically possible’ alternative meanings (TPAMs) as a standard component of their interpretive process. It is proposed that, when considering whether any TPAMs exist in addition to the practitioner’s primary investigative hypothesis regarding a data trace, the practitioner’s position may be expressed in one of six ways – ‘the six categories of TPAM’, based upon the available objective support related to or present within their case, from which the TPAM is derived. These six categories are proposed in order to help a practitioner effectively communicate their reasoning for offering a TPAM in regards to any data trace found during an investigation and are defined and discussed.