PSBK Vol. 3 Update: The Casework Book I Wish Existed
PSBK Vol. 3 Update: The Casework Book I Wish Existed
This volume has been the hardest thing I’ve written because it’s not a “how to click” book. I have learned that it is much easier to write ‘how to run a tool book’ than it is to write ‘when and why (or if)’ to use a tool or ‘which tool is best to use in a million different situations.’ It’s also taking me longer to write this book than working a string of cases…because it’s harder than working a string of cases..
So, DF/IR Investigative Strategies (ie: volume 3 of Placing the Suspect Behind the Keyboard) is a how to work a case book, from event to adjudication, using whatever tool fits for the problem at hand. Every chapter forces decisions: Which tool? When (or whether) to use it at all? What do you do with what’s in the box and what’s outside the box? I even get into IR territory from a DF vantage point in the book.
To make those decisions real, I picked (and still picking) specific tools to demonstrate strategies that are common in both civil and criminal cases. For the cell-phone triage sequence, I chose ADF Solutions. Not because a vendor comp’d me a license (they didn’t…), but because in this scenario I needed: simplicity, speed to actionable leads, and explainability. ADF fits what I needed for the demonstration I have created. I have a list of other tools to solve other problems that I’ll talk about in future posts as I finish each chapter.
What makes DF/IR Investigative Strategies different (and painfully difficult to write)
- Scenario-first, not tool-first. In real life, you’re dropped into a case or a case is dropped on you. You make calls under pressure with limited time, with incomplete facts, and with the legal aspects to consider. This book addresses that.
- Decisions, not demos. Tools appear in the book only when they serve the strategy of working a problem. If the right move is “do nothing yet,” then the book addresses doing nothing on purpose (in a specific situation).
- Inside + outside the box. Phone, laptop, cloud, cameras, vehicle data, people. Evidence doesn’t care what team you’re on or if you know where to find it. DF/IR investigative strategies in a real case means that every matter is dependent on what is outside the box just as much as what is in the box. Same with this book.
- DF/IR boundary crossing. Containment and evidence preservation sometimes need to be choreographed to meet both objectives (containment and evidence). The book shows how to do that without contaminating either mission in a way that fulfills both IR and DF.
Back to phone triage
In the book, I have picked a lot of software applications to use in solving different, but common problems. In the triage that I created in the book, I needed a workflow that a trained examiner could do cleanly, produce immediate, reviewable artifacts, and hand off defensibly after producing actionable intelligence.
Other scenarios may be better with other tools, but for this one, ADF does exactly what I need to show. Consider that in a phone triage where time is limited (like exigent circumstances), getting a real-time preview, keyword searches, screen/video capture with OCR, and fast acquisition in minutes is a beneficial thing for actionable intelligence in a forensically sound manner.
For each tool’s strengths, I am not glossing over weaknesses, because part of your investigative strategy is knowing which tool is right for your problem and which is not. For example, an unsupported or locked phone would not be the problem solved with ADF Solutions (or very many other tools either!). This brings me to a theme that I’ll leak out now, is that there never is the best tool for any problem, only a right tool for a problem.
Never marry a tool. Marry a process that works in choosing the right tool for the appropriate problem.
Tools parse. Humans prove.
Another ongoing theme of the book is that you, the investigator, analyst, examiner or whatever your title may be, must prove your case. That doesn’t mean winning it. It means uncovering and proving the truth. When the objective changes, the tool may change. When the situation changes, the tool may change with it, or just the way the tool is used changes. The book shows those handoffs just like in real life.
Timeline & next steps
I’ll keep sharing bits of this book as I wrap up each drafted chapter. If you care more about how investigators think than how they click, Vol. 3 is being written for you.
Bottom line: This book is about making better investigative decisions. In the phone triage scenario, ADF helped me do that fast, simply, and defensibly. When it isn’t the right tool, I show you that too. And of course, I am including free, open source, free and open source, and other commercial tools. It just depends on the problem that I want to show and the right tool for that job.
Today’s book disclosures
1-ADF Solutions https://www.adfsolutions.com/ (side note – I mentioned ADF Solutions in the first volume way back in 2013 (Placing the Suspect Behind the Keyboard), but ADF has grown so much since then in feature and function that I am giving it a lot more space in this book than just an honorable mention).
2-Theme: The right tools. Pick the right (not necessarily the ‘best’) tool to solve the problem.
3-Theme: Prove your case. Tools parse data. You solve cases.