Digital Evidence Certainty Descriptors (DECDs)

Abstract Whilst many other traditional forensic science disciplines are encouraged to describe the weight of their evidence in some form of quantifiable measurement/expression, this is rarely done in digital forensics. There are calls to rectify this situation, suggesting that the field should begin to develop more robust, scientific methods for evaluating the digital evidence presented by its practitioners. Whilst such a recommendation carries a number of potential benefits, caution must be exercised as at present there are no available satisfactory methods for achieving this. This work suggests that attaining such methods may not actually be possible due to the intricacies of digital data and the difficulties involved with the fine-grained interpretation of events. As a result it is argued that attempts to quantify any uncertainty should be abandoned in favour of methods which reliably describe when uncertainty exists and in what capacity. Here, the Digital Evidence Certainty Descriptors (DECDs) framework is offered as a method for conveying when uncertainty exists in a set of digital findings. The DECDs framework is discussed and applied to working examples to demonstrate the difficulties involved with determining the authenticity of a given hypothesis regarding digital evidence.

[1]  Graeme Horsman,et al.  Raiders of the lost artefacts: Championing the need for digital forensics research , 2019, Forensic Science International: Reports.

[2]  Graeme Horsman,et al.  Framework for Reliable Experimental Design (FRED): A research framework to ensure the dependable interpretation of digital data for digital forensics , 2018, Comput. Secur..

[3]  Anders Nordgaard,et al.  The likelihood ratio as value of evidence—more than a question of numbers , 2012 .

[4]  Graeme Horsman,et al.  A case-based reasoning method for locating evidence during digital forensic device triage , 2014, Decis. Support Syst..

[5]  W. Thompson,et al.  Lay understanding of forensic statistics: Evaluation of random match probabilities, likelihood ratios, and verbal equivalents. , 2015, Law and human behavior.

[6]  Richard E. Overill,et al.  Quantification of digital forensic hypotheses using probability theory , 2013, 2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE).

[7]  Filipo Sharevski.  Rules of professional responsibility in digital forensics: A comparative analysis , 2015, J. Digit. Forensics Secur. Law.

[8]  Cedric Neumann,et al.  An argument against presenting interval quantifications as a surrogate for the value of evidence. , 2016, Science & justice : journal of the Forensic Science Society.

[9]  Graeme Horsman,et al.  Formalising investigative decision making in digital forensics: Proposing the Digital Evidence Reporting and Decision Support (DERDS) framework , 2019, Digit. Investig..

[10]  Law. Policy.  Executive Summary of the National Academies of Science Reports, Strengthening Forensic Science in the United States: A Path Forward , 2009 .

[11]  James M Curran,et al.  Admitting to uncertainty in the LR. , 2016, Science & justice : journal of the Forensic Science Society.

[12]  Geoffrey Stewart Morrison,et al.  What should a forensic practitioner's likelihood ratio be? , 2016, Science & justice : journal of the Forensic Science Society.

[13]  Nenagh Kemp,et al.  Forensic scientists' conclusions: how readable are they for non-scientist report-users? , 2013, Forensic science international.

[14]  Ian Watkins,et al.  The expression and interpretation of uncertain forensic science evidence: verbal equivalence, evidence strength, and the weak evidence effect. , 2013, Law and human behavior.

[15]  Geoffrey Stewart Morrison,et al.  Measuring the validity and reliability of forensic likelihood-ratio systems. , 2011, Science & justice : journal of the Forensic Science Society.

[16]  Charles E H Berger,et al.  The LR does not exist. , 2016, Science & justice : journal of the Forensic Science Society.

[17]  Steven P. Lund,et al.  Likelihood Ratio as Weight of Forensic Evidence: A Closer Look. , 2017, Journal of research of the National Institute of Standards and Technology.

[18]  Debra Littlejohn Shinder,et al.  Scene of the Cybercrime , 2002 .

[19]  Michael J. Saks,et al.  The Testimony of Forensic Identification Science: What Expert Witnesses Say and What Factfinders Hear , 2009, Law and human behavior.

[20]  Eoghan Casey,et al.  Clearly conveying digital forensic results , 2018, Digit. Investig..

[21]  Ricky Ansell,et al.  Scale of conclusions for the value of evidence , 2012 .

[22]  William C. Thompson.  Discussion Paper: Hard Cases Make Bad Law -- Reactions to R v. T , 2012 .

[23]  Richard E. Overill.  Quantifying Likelihood in Digital Forensic Investigations , 2014 .

[24]  Peter Sommer.  Meetings between experts: A route to simpler, fairer trials? , 2009, Digit. Investig..

[25]  P. Sommer.  Certification, registration and assessment of digital forensic experts: The UK experience , 2011, Digit. Investig..

[26]  Eoghan Casey.  Error, Uncertainty and Loss in Digital Evidence , 2002, Int. J. Digit. EVid..