Timeline analysis

During the investigation, you may find artifacts that appear to show the accused’s guilt or innocence. However, we cannot construe the mere presence of the artifact as a sign of the suspect’s guilt or innocence. Instead, the artifact needs to be placed within the user and system activity context.

For example, I was brought in as a consultant on a case; they accused the suspect of physically abusing their child. One piece of evidence that was considered against the suspect was the high number of Google searches about how to treat an injury. They attributed the searches to the accused, who was the father. The most challenging piece of evidence is to prove the user’s identity behind the keyboard when the contested actions occurred. Since the items were present in the internet history (we will go into much greater detail in Chapter 9, Internet Artifacts), I wanted to check the context of when the searches were made. The wife was the primary...