Digital forensics analysis is the easy part of an investigation. That is not to say that the work of digital forensics is simple, but rather recovering electronic data is a rote routine of data carving and visual inspection of data. Interpreting the data requires a different type of effort to put together a story of what happened ‘on the computer’. As important an analysis is to determine computer use, it is just as important to identify the user or users and attribute computer activity to each user. An investigation without an identified suspect is a case that remains open and unsolved..sometimes for years or forever.
In many investigations (civil and criminal), identifying the computer user is obvious through confessions or by process of elimination. Proving a specific person was at the keyboard is barely a consideration since the person either admitted control of the device or was caught red-handed and the examiner can focus more on the user activity on the computer devices rather than spending time identifying the user.
However, simply accepting the suspect’s identity without further investigation into other aspects of the suspect’s identity may sell the investigation short. Whether the suspect is known or unknown, compiling a complete identity of the suspect adds important information that is beneficial to a case, such as motives, intentions, and identification of more crimes. The most important point is that a physical person that has been identified, or even arrested, does not give a complete identity of that person. It is only the physical identity. Investigators should strive to compile a complete identity that includes digital identities.
So what’s in it for you?
Building a case against a suspect requires more than just finding evidence. A case needs evidence to point to a suspect as well as showing motive and opportunity. Providing evidence of every identified persona of a suspect paints a picture of the suspect, to include intent, desires, motive, behaviors, and overall character to add to the supporting evidence. In short, you get a better case....