March 27, 2015
Tenacity & Objectivity: The Double-Edged Sword of Digital
Forensics
In our article with tips on how to select a competent
digital forensic examiner, we touched on two important attributes of competent
examiners that I'd like to expand upon - Tenacity & objectivity. The two traits are extremely important and
can often be at odds with each other when it comes to working cases at all
levels, including digital forensic examinations. It's that conflict that bears some
exploration within the field of digital forensics and investigation.
Tenacity
Tenacity is a trait that many people don't have, but one
that extremely important in investigations at all levels. To me, tenacity means
leaving no proverbial stone unturned.
Looking at all of the factors and options in a given case before putting
the stamp of "closed" on your findings. I recently told an attorney that I never
think I'm done and I always think there's more evidence to find. Of course, one has to be careful not pursue
rabbit holes or wild goose chases, but with experience & training, a
competent investigator can discriminate between potentially irrelevant
information and evidence that can provide value in a given case.
The problem with tenacity is ego. Ego is another subject we've discussed in this
blog, but it bears mentioning that tenacity requires a personal
"motor" -- the drive to want to find out what's going on and to
follow the investigation to its natural conclusion. But when and investigator or examiner gets
personally involved in a case, his tenacity can sometimes lead to tainted
findings by looking at the case through the lens of his own ego. This is an extremely dangerous area to
operate in and one that many investigators fail to recognize in themselves. The other problem with the ego's relationship
to tenacity is the psychological snowball effect that comes from being a
competent investigator or examiner who experiences repeated success. With each case, confidence & ego build
and the ability to look at cases objectively decreases, which leads to bad work
product.
Objectivity
If tenacity is the motor that drives a competent examiner or
investigator, then objectivity is the preventative maintenance that keeps the
motor running efficiently & effectively.
It is incumbent upon professionals in the field to wipe the slate clean
with every new case, thus maintaining a position of objectivity. As a famous podcaster often says, always keep
in mind that you're just not that good. Maintaining objectivity with every new case
ensures appropriate work flow and adherence to best practices. Objectivity requires putting one's ego in
check and following the evidence to conclusions, as opposed to following
conclusions to evidence. Objectivity
also has the great benefit of increasing credibility in legal proceedings and
with professional reputation overall.
When initiating an investigation, it would be beneficial to
start from a place of not caring who is responsible. Care about the evidence, care about the
facts, care about the truth. Don't care
about the ancillary or even political factors that can affect a case because
this leads to loss of objectivity. Yes,
I know this is sometimes easier said than done, but it's also what separates
true professionals from those who are less professional.
Conclusions
The fact that tenacity & objectivity are not only vital
in every case, but potentially very much at odds with each other in every case
cannot be overstated. Even with trained,
dedicated professionals, the internal struggle with wanting to do a GOOD job
and bring out the facts in any given case while maintaining objectivity occurs
at virtually every level. But these two
traits are so vitally important to a complete & appropriate investigation
that they need to be at the top of the list for any decent investigator,
digital forensic examiner or forensic practitioner.
If you're tenacious, embrace it. Nurture and hone your tenacity because it's
what makes you an effective, intuitive investigator. Just be careful. As I've seen repeatedly throughout both law
enforcement & the private sector, success tends to breed an over-inflated
sense of self-worth. A healthy dose of
objectivity about your cases and about yourself is also vital to maintaining
integrity of investigations and ensuring the proper outcome in all aspects of
the case.
Patrick J.
Siewert, SCERS, BCERT, LCE
Principal
Consultant
Professional
Digital Forensic Consulting, LLC
Based in
Richmond, Virginia
Available
Globally
About the Author:
Patrick Siewert is the Principal
Consultant of Pro Digital Forensic Consulting, based in Richmond,
Virginia. In 15 years of law
enforcement, he investigated hundreds of high-tech crimes, incorporating
digital forensics into the investigations, and was responsible for
investigating some of the highest jury and plea bargain child exploitation
cases in Virginia court history. A
graduate of both SCERS and BCERT (among others), Siewert continues to hone his
digital forensic expertise in the private sector while growing his consulting
business marketed toward litigators, professional investigators and
corporations.
Twitter: ProDigital4n6
