Hypothesis Testing
Definition
In digital forensics, the practice of forming a specific, falsifiable proposition about what occurred (such as 'the attacker used account X to exfiltrate data between 02:00 and 04:00 UTC') and then searching the evidence specifically to confirm or refute it. Prevents confirmation bias from driving the analysis.
- Field
- Digital forensic analysis
- Function
- Forms a specific, falsifiable proposition, then searches evidence to test it
- Benefit
- Guards against confirmation bias driving the analysis
- Typical proposition element
- A named account, action, and time window
Common questions
How does hypothesis testing change how an examiner searches a large evidence set?+
Instead of browsing broadly and noting anything that seems suspicious, the examiner runs targeted queries designed to confirm or rule out the specific proposition, which keeps the search scope defensible and documented for later review.
What should an examiner do if the evidence contradicts the initial hypothesis?+
The proposition is revised or rejected based on what the evidence actually shows, and the new finding is documented alongside the original hypothesis, rather than being discarded or omitted from the report.
Related terms
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Link Analysis
- A graph-based analytical technique that maps entities (IP addresses, domains, accounts, phone numbers, wallets) as nodes and relationships (communications, ownership, transactions) as...
- NetFlow
- A network protocol (originally Cisco, now standardised as IPFIX under RFC 7011) that records metadata about IP traffic flows: source and destination...
- SIEM (Security Information and Event Management)
- A platform that aggregates log and event data from systems, networks, and applications across an environment, correlates events against detection rules, generates...
- Timeline Reconstruction
- The process of ordering digital events from multiple sources into a single chronological account. Requires normalising all timestamps to a common reference...