Bias in the Digital Evidence Journey

Now that we have looked at what bias is, we can consider where it might influence the journey of digital evidence.

Digital evidence can pass between first responders, investigators, forensic practitioners and other professionals. Information may be recorded in formal requests and reports, discussed in conversations and passed between different teams.

Each of these stages involves people deciding what is important, what should be communicated and how information should be interpreted.

When an early theory shapes the investigation

Investigators often need to develop possible explanations before all the evidence is available.

As an investigation progresses, there is a risk that information supporting an early theory receives more attention than information that challenges it. This is an example of confirmation bias.

For example, an early assumption about a suspect might influence which lines of enquiry are prioritised, what information is requested from a device or how new evidence is interpreted.

The person making these decisions does not need to be deliberately ignoring contradictory information for this influence to occur.

When wider information influences examination

Bias can also arise when someone receives information about a case that is not necessary for the task they are carrying out.

Imagine that a digital forensic practitioner is examining a device and is told that investigators strongly suspect its owner committed the offence.

That information may not be needed to carry out the examination, but it could still influence what appears significant or how findings are initially interpreted. This is an example of contextual bias.

Bias across the evidence journey

The important point is that these influences do not necessarily remain at one stage of an investigation.

An early assumption might affect what is included in an examination request. A conversation might introduce additional contextual information. The findings of an examination might then influence the next investigative decision.

Looking across the whole digital evidence journey therefore helps us identify where unintended influences might enter the process and how they could affect later stages.

As you continue through this module, we will look more closely at some of the factors involved, particularly communication, language, organisational culture and information flow.

Knowledge Check

Move to the next page by clicking the arrow on the top right to move to the next page in this section.