Forensic data analysis: Difference between revisions

Revision as of 16:16, 21 November 2017

Revision as of 16:34, 4 December 2017

Line 14:

After an initial analysis phase using methods of [[explorative data analysis]] the following phase is usually highly iterative. Starting with a hypothesis on how the perpetrator might have created a personal advantage the data is analyzed for supporting evidence. Following that the hypothesis is refined or discarded.

The combination of different databases, in particular data from different systems or sources is highly effective. These data sources are either unknown to the perpetrator or he/shesuch that they can not manipulatebe manipulated by the themperpetrator afterwards.

[[Data visualization|Data Visualization]] is often used to display the results.