Towards a digital forensic science

Abstract

The scientific principles that underlie digital forensic science are still not clear. Possible foundations have been proposed by Gladyshev, Carrier, Cohen, The Scientific Working Group on Digital Evidence of the US Department of Justice and others. However, all these proposals, although valuable contributions, do not provide a satisfactory scientific basis. The current article argues that the search for a suitable foundation is hampered by the conflation of science used for investigative purposes and science used for probative purposes. We argue that some aspects of forensic science are indeed useful for both purposes, but that large portions of the application of science for use in matters of law are only applicable to one of these categories. The paper focuses on the probative use of science for matters of law. We suggest that the explicit focus on proof (rather than investigation) leads to a clearer understanding of the notion of the claims to be proven. Based on this it is shown that such claims may be expressed as propositions that can be proven, disproven, or determined to be ambiguous given the available evidence using well-known computing concepts. It also indicates how this approach helps one to determine the accuracy (which will not always be the opposite of error rates) of any findings. Given its specific focus the paper establishes a basis for digital forensic science without asserting that it is the only possible scientific basis.