| Abstract: | In last month’s column we started the correlation process. This early work simply looked at individual pieces of evidence as they might relate to other pieces of evidence. However, there are some potential pitfalls if we stop here. First, digital evidence can be ambiguous. In other words, we can see the same event reported by various sources in various ways. Are we really looking at the same event, or are we looking at different ones? The second issue is that events may be reported in unusual ways leading the analyst to believe that the event occurred multiple times when, in fact, it did not. We need processes to analyze all the events that are reported and to help us to understand the actual data that we are seeing. Fortunately, we actually have two: normalization and deconfliction. Those two processes will be the topics of this month’s offering. |
