Devising the Analytical Processes for Information Processing in Digital Investigations

Overview

Michel Fiola's employment was terminated and the individual faced criminal charges when illicit activity and material was identified and located on his workplace system.

Materials

Task: Analytical Processes

Figure 1 illustrates further development of the cognitive model. Pairs should now consider the analytical or top-down processes that support investigators in progressing Presentation back to the External Data Sources.

Pairs have been given the initial analytical process of Re-evaluate, where investigators upon receiving additional information from clients may reconsider their hypothesis or consider alternative theories. Pairs have also been given the last analytical process of Search for Information, where investigators may seek additional information from the data or reconsider the data already collected.

image
Figure 1: Analytical processes that support progression through the cognitive steps.

Pairs are advised that Michael Fiola disputes the allegations made. This can be observed in the interview with Michael Fiola.

Pairs should determine an alternative theory or explanation from consideration of the second log file as well as devise at least THREE other key analytical processes that support investigators in progressing from Presentation down to External Data Sources.

Learners should:

  1. Consider second log file [10 minutes]. The partner that acted as coach in the previous task, should now consider the second log file in this task. The partner considering the second log file should formulate an alternative theory that may explain the data points, the member should think aloud the actions and steps they are taking.

  2. Support, encourage and identify [10 minutes]. The other partner should act as coach this time and monitor the partner considering the second log file. The coach should support and encourage the other partner, for example: praising when they make a useful insight and correcting if they make a mistake. The other partner should also identify the analytical processes that the other partner is performing in considering the data. The partner should note down the potential analytical processes on the sticky notes or index cards provided.

  3. Consolidate abstraction process [5 minutes]. The pair should now consolidate the potential analytical processes into no more than THREE that fit within the current model.

  4. Document [3 minutes]. Pairs should produce a THREE minute presentation, one minute articulating and providing justification for each of the analytical processes.