The Role of Maths in Digital Forensic Investigations

One of the many benefits of learning digital forensics is that we walk through the door eager to learn how to solve crimes. We find much of the information investigated in forensics is always new information. To successfully produce evidence, one needs to have a strong background in mathematics, statistics, science, technology and writing. Digital forensics is a fascinating field requiring a multi-disciplinary approach. The science of digital forensics is rooted in computer science, and the computer science is rooted in mathematics, which is fast becoming one of the most important techniques in crime detection. 

Mathematics helps us think analytically and have better reasoning abilities. Analytical thinking refers to the ability to think critically about the crime. Reasoning is our ability to think logically about a situation. Analytical and reasoning skills are important because they help us solve problems and look for solutions in the investigation. Mathematics not only helps in framing a problem, also helps in identifying the knowns and unknowns, and taking steps to solve the problem. It is essential for digital forensic researchers to have good understanding of the relevant mathematical concepts, directly and/or indirectly.

- What is a statistically significant number of appearances of a search string in your results?

- What is a Message Digest 5 (MD5) hash or Secure Hash Algorithm 1 (SHA1) and how are they calculated?

- What is the hex representation of a string and what is its significant?

- What happens when you use OR in a search term rather than use AND? - search results of different search constructions

- Regular expressions are all about sets (unions/disjoints/intersections), functions and logical operators. How to effectively use it?

- Discrete mathematics is a logic math that helps to deduct certain outcomes or situations and how it all makes sense – learning about algorithms and Boolean algebra.

- Binary, octal and hexadecimal maths are invaluable.

- Knowledge of computational complexity is good, as it gives an idea of how long we have to wait.

- Pascal's Triangle is helpful as well.

- Knowledge of cryptography, statistics, error-checking and correcting are important as well.

- Statistics can be a precious tool when identifying the patterns behind confusing or misleading phenomena.

- Hash algorithms are a mathematical formula that provide verification of evidence accuracy, ensuring two data sets are the exact same content. Technically, a hash function takes binary data, called the message, and produces a condensed representation, called the “message digest”. The mathematical certitude is higher than DNA. MD5 and SHA-1 are two of the most widely used.