Considering ‘technically possible’ alternative meanings for data traces found during a digital forensic examination

Simple item page
dc.contributor.authorHorsman, Graeme
dc.date.accessioned2022-05-17T11:20:21Z
dc.date.available2022-05-17T11:20:21Z
dc.date.issued2022-05-09
dc.description.abstractAs part of a digital forensic examination, a practitioner may identify data traces that they believe to be relevant to their inquiry and seek to interpret their meaning, forming a primary investigative hypothesis. In addition, practitioners should also consider whether any traces could mean something else. This work discusses the need for practitioners to consider ‘technically possible’ alternative meanings (TPAMs) as a standard component of their interpretive process. It is proposed that, when considering whether any TPAMs exist in addition to the practitioner’s primary investigative hypothesis regarding a data trace, the practitioner’s position may be expressed in one of six ways – ‘the six categories of TPAM’, based upon the available objective support related to or present within their case, from which the TPAM is derived. These six categories are proposed in order to help a practitioner effectively communicate their reasoning for offering a TPAM in regards to any data trace found during an investigation and are defined and discussed.en_UK
dc.identifier.citationHorsman G. (2023) Considering ‘technically possible’ alternative meanings for data traces found during a digital forensic examination. Australian Journal of Forensic Sciences, Volume 55, Issue 5, September 2023, pp. 689-698en_UK
dc.identifier.issn0045-0618
dc.identifier.urihttps://doi.org/10.1080/00450618.2022.2071988
dc.identifier.urihttp://dspace.lib.cranfield.ac.uk/handle/1826/17900
dc.language.isoenen_UK
dc.publisherTaylor and Francisen_UK
dc.rightsAttribution-NonCommercial 4.0 International*
dc.rights.urihttp://creativecommons.org/licenses/by-nc/4.0/*
dc.subjectDigital forensicsen_UK
dc.subjecthypothesisen_UK
dc.subjectinterpretationen_UK
dc.subjectalternative possible meaningen_UK
dc.subjectinvestigationen_UK
dc.titleConsidering ‘technically possible’ alternative meanings for data traces found during a digital forensic examinationen_UK
dc.typeArticleen_UK

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
alternative_meanings_for_data_traces-2022.pdf
Size:
374.07 KB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.63 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

Staff publications (CDS)