Digital Evidence and Computer Crime, 3rd Edition

Chapter 8

Investigative Reconstruction with Digital Evidence

Eoghan Casey and Brent E. Turvey

Contents

Equivocal Forensic Analysis

Victimology

Crime Scene Characteristics

Threshold Assessments

Reconstructing human behavior from physical evidence is a multidimensional jigsaw puzzle. Pieces of the puzzle are missing, damaged, and some are even camouflaged. The puzzle pieces come in seemingly incompatible data types—some are visual, some are in such microscopic form that it takes days of specialized analysis to show their existence and in some cases the evidence is intangible, such as oral testimony. But practitioners of these two disciplines, each for totally different reasons, sit at their desks and doggedly persist in completing these puzzles—archaeologists ...