Friday, March 27, 2015

Tenacity & Objectivity: The Double-Edged Sword of Digital Forensics

March 27, 2015

Tenacity & Objectivity: The Double-Edged Sword of Digital Forensics

In our article with tips on how to select a competent digital forensic examiner, we touched on two important attributes of competent examiners that I'd like to expand upon - Tenacity & objectivity.  The two traits are extremely important and can often be at odds with each other when it comes to working cases at all levels, including digital forensic examinations.  It's that conflict that bears some exploration within the field of digital forensics and investigation.


Tenacity is a trait that many people don't have, but one that extremely important in investigations at all levels. To me, tenacity means leaving no proverbial stone unturned.  Looking at all of the factors and options in a given case before putting the stamp of "closed" on your findings.  I recently told an attorney that I never think I'm done and I always think there's more evidence to find.  Of course, one has to be careful not pursue rabbit holes or wild goose chases, but with experience & training, a competent investigator can discriminate between potentially irrelevant information and evidence that can provide value in a given case. 

The problem with tenacity is ego.  Ego is another subject we've discussed in this blog, but it bears mentioning that tenacity requires a personal "motor" -- the drive to want to find out what's going on and to follow the investigation to its natural conclusion.  But when and investigator or examiner gets personally involved in a case, his tenacity can sometimes lead to tainted findings by looking at the case through the lens of his own ego.  This is an extremely dangerous area to operate in and one that many investigators fail to recognize in themselves.  The other problem with the ego's relationship to tenacity is the psychological snowball effect that comes from being a competent investigator or examiner who experiences repeated success.  With each case, confidence & ego build and the ability to look at cases objectively decreases, which leads to bad work product.


If tenacity is the motor that drives a competent examiner or investigator, then objectivity is the preventative maintenance that keeps the motor running efficiently & effectively.  It is incumbent upon professionals in the field to wipe the slate clean with every new case, thus maintaining a position of objectivity.  As a famous podcaster often says, always keep in mind that you're just not that good.  Maintaining objectivity with every new case ensures appropriate work flow and adherence to best practices.  Objectivity requires putting one's ego in check and following the evidence to conclusions, as opposed to following conclusions to evidence.  Objectivity also has the great benefit of increasing credibility in legal proceedings and with professional reputation overall.

When initiating an investigation, it would be beneficial to start from a place of not caring who is responsible.  Care about the evidence, care about the facts, care about the truth.  Don't care about the ancillary or even political factors that can affect a case because this leads to loss of objectivity.  Yes, I know this is sometimes easier said than done, but it's also what separates true professionals from those who are less professional.


The fact that tenacity & objectivity are not only vital in every case, but potentially very much at odds with each other in every case cannot be overstated.  Even with trained, dedicated professionals, the internal struggle with wanting to do a GOOD job and bring out the facts in any given case while maintaining objectivity occurs at virtually every level.  But these two traits are so vitally important to a complete & appropriate investigation that they need to be at the top of the list for any decent investigator, digital forensic examiner or forensic practitioner. 

If you're tenacious, embrace it.  Nurture and hone your tenacity because it's what makes you an effective, intuitive investigator.  Just be careful.  As I've seen repeatedly throughout both law enforcement & the private sector, success tends to breed an over-inflated sense of self-worth.  A healthy dose of objectivity about your cases and about yourself is also vital to maintaining integrity of investigations and ensuring the proper outcome in all aspects of the case.

Patrick J. Siewert, SCERS, BCERT, LCE
Principal Consultant
Professional Digital Forensic Consulting, LLC
Based in Richmond, Virginia
Available Globally

About the Author:
Patrick Siewert is the Principal Consultant of Pro Digital Forensic Consulting, based in Richmond, Virginia.  In 15 years of law enforcement, he investigated hundreds of high-tech crimes, incorporating digital forensics into the investigations, and was responsible for investigating some of the highest jury and plea bargain child exploitation cases in Virginia court history.  A graduate of both SCERS and BCERT (among others), Siewert continues to hone his digital forensic expertise in the private sector while growing his consulting business marketed toward litigators, professional investigators and corporations.
Twitter: ProDigital4n6