If an action happens that affects a computer system, observation of the affected data in the system could be used a evidence to reduce the possible states the system could have been in before it’s current state. At a minimum when conflicting statements occur, these indicate that one or both statements should be investigated further to find either inculpatory or exculpatory evidence. A witness statement may not be true for a number of reasons, but the statement may be highly probable. For example, if a trustworthy witness says she saw a specific suspect at a specific time, and the suspect claims to be out of the country at that time, these are conflicting statements. When an investigator gets statements from witnesses, the investigator can then begin to restrict possibilities of happened events based on the information. For example, a statement from a witness that is known to lie may be considered less trustworthy Similarly, in the digital realm, information gathered from a device may be less trustworthy if the device has been known to be compromised by a hacker or virus. Once a witness provides a statement, the investigator needs to evaluate the level of trust he or she places in the validity of the statement. While a witness may traditionally be a human, a digital device – such as a computer or cell phone – could also help to provide information about an event. A “witness” could be considered as anything that provides information about the occurrence of an event. When conducting an investigation, many statements are given by witnesses and suspects.
0 kommentar(er)
