Digital Forensics / Basic: scope, integrity, and interpretation / Lesson 6

Keep observations, hypotheses, and alternatives distinct

Build an analytical notebook that can be challenged rather than a narrative that selects only confirming material.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

State what an artifact shows separately from what it might explain.
Use disconfirming and missing observations to test competing hypotheses.

Label each kind of analytical statement

“Record e3 contains version 2” is an observation about supplied material. “An import replaced version 1” is a hypothesis about a mechanism. “A particular person intended the replacement” adds attribution and intent that the fixture may not support. Label these layers so another reader can challenge the reasoning. A notebook should retain the exact artifact reference and method for each observation. Do not rewrite uncertain interpretation as a direct fact merely because it makes the final story shorter. Clear distinctions help later findings survive contradictory evidence without losing their supporting observations.

Compare explanations against explicit observations

For the fictional record change, consider an authorized import, a duplicate processing path, and a display-only parsing error. Each predicts different observations. The first record connects hypotheses to required checks rather than assigning an unsupported probability. It is a non-runnable plan with invented ids. Do not claim that a missing expected log conclusively disproves an explanation when retention or logging coverage is unknown. Instead, state whether the check is supported, contradicted, or unresolved under the available material and identify what could distinguish the alternatives.

json A fictional competing-hypothesis plan

{"question":"why-fixture-version-differs","hypotheses":[{"id":"h-import","check":"matching-import-id-and-source-version"},{"id":"h-duplicate","check":"repeated-commit-for-same-action"},{"id":"h-display","check":"independent-byte-interpretation"}],"probabilitiesAssigned":false}

The non-runnable plan names discriminating checks without claiming any was executed. It is not a real case assessment or attribution. Each proposed check still needs material, a method, and an observation before supporting a conclusion.

Preserve observations that do not fit

A second artifact can disagree with an initial explanation because of a different source view, delayed recording, parser behavior, or a genuinely different event. Preserve the conflict before choosing a repair. The program groups declared assessments and keeps unresolved checks visible. It does not evaluate the truth of the assessments. A tidy summary that drops unresolved rows can create false confidence. Use the local exercise to understand the notebook structure, then demand actual artifact references and method evidence for each status in a real approved analysis.

python Keep all declared analytical statuses in a summary

checks = [{"id":"c1","status":"supported"}, {"id":"c2","status":"contradicted"}, {"id":"c3","status":"unresolved"}]
groups = {state:[c["id"] for c in checks if c["status"] == state] for state in ("supported", "contradicted", "unresolved")}
assert groups["supported"] == ["c1"]
assert groups["contradicted"] == ["c2"]
assert groups["unresolved"] == ["c3"]
print("support, contradiction, and uncertainty retained")

Expected output

support, contradiction, and uncertainty retained

The complete program organizes three invented assessments and performs no artifact examination. It proves only that the summary retains each status. It does not calculate confidence, identify a cause, or resolve the contradiction.

Look for the observation that could change your view

Confirmation bias appears when an analyst searches only for material consistent with the preferred explanation. Ask what would be expected if the alternative were true and what observation would make the current explanation untenable. Seek independent corroboration rather than repeating the same derived source in several tools. Two reports generated from one log are not automatically two independent witnesses. Record source dependencies in the notebook. A useful question is whether the apparent agreement survives a different parser or an independently generated fixture with a known expected result.

Report supported findings and open questions together

The final narrative can be concise while retaining a traceable distinction between findings and hypotheses. State the material, method, supporting observations, conflicting observations, and unresolved limits. Use confidence language only with an explained basis rather than a decorative percentage. If the evidence supports a version difference but not its cause, say exactly that. A reproducible partial finding is more useful than a complete invented story. The course supplies no real incident evidence or attribution and makes no legal conclusion; its purpose is disciplined reasoning over controlled synthetic material.

Common errors and fixes

A hypothesis becomes a fact in the summary

Why it happens: The statement loses its evidentiary qualification.
How to fix it: Label observation and interpretation separately.
Prevent it next time: Trace each conclusion to exact artifacts and methods.

Two tools reading one source are called independent evidence

Why it happens: Shared input dependencies are ignored.
How to fix it: Map derivation and seek genuinely independent corroboration.
Prevent it next time: Record source relationships in the notebook.

Unresolved rows disappear from the report

Why it happens: Missing evidence is hidden by summary formatting.
How to fix it: Retain uncertainty and its effect on the question.
Prevent it next time: Review omitted and contradictory observations before closure.

Check your understanding

1. A version difference is reproducible but no artifact identifies the mechanism. What can be concluded?

Show worked solution

The supplied versions differ under the verified comparison, while the cause remains unresolved. List plausible mechanisms and the observations needed to distinguish them. Do not infer import, deliberate tampering, or a person’s intent merely because one explanation feels likely.

2. Why is an absent log line weak disconfirmation when coverage is unknown?