Placing the Suspect Behind the Keyboard: How Full is Your Gas Tank?

One of the most critical tasks in digital forensics and incident response (DFIR) is attributing a cyber incident or crime to a specific suspect. This process, referred to as placing the suspect behind the keyboard, requires meticulous analysis, evidence gathering, and interpretation—in effect, an investigation.

But how confident can we be in our findings? How full is our “gas tank” of certainty? Let’s explore the spectrum of certainty terms to understand confidence levels in attributing an incident to a specific individual.

Impossible: Running on Empty

At the lowest end of the spectrum, we have the term “impossible.” In an investigation, there is no conceivable way to link the suspect to the incident. Perhaps the suspect has a rock-solid alibi, or technical evidence places them physically away from the scene. For instance, if logs and timestamps, witness statements, or security footage unequivocally show the suspect was offline or in a different geographical location, then attributing the incident to them is impossible. This is like running on an empty gas tank – no fuel for your argument.

Improbable: A Few Drops in the Tank

When something is “improbable,” it means there is some remote chance, but it’s highly unlikely. This could mean that while some minimal traces might link a suspect to the incident, these are outweighed by stronger evidence to the contrary. For example, a suspect might have had access to a compromised system, but their behavior logs show no suspicious activity. This is akin to having a few drops of gas – not enough to make a convincing case.

Possible: A Quarter Tank

“Possible” indicates a conceivable way the suspect could be linked to the incident. At this level, evidence such as IP addresses, login attempts, or device usage might point toward the suspect, but there isn’t enough to make a solid claim. This situation is like having a quarter tank of gas – you can get somewhere, but not far enough to get far.

Probable: Half Tank

When something is “probable,” there is a good chance it is true. In DFIR investigations, probable means that the evidence starts to build a convincing case against the suspect. There may be logs showing suspicious activity from the suspect’s account, files accessed that only they had permission for, or patterns of behavior that align with the attack timeline. This level of certainty is comparable to having a half tank of gas – you’re on your way, but there’s still some distance to cover.

Likely: Three-Quarters Tank

“Likely” suggests a high probability of correctness. This means the suspect’s connection to the incident is strongly supported by multiple pieces of evidence. This could include a combination of digital fingerprints, such as consistent IP addresses, correlating timestamps, and corroborative witness statements. Your gas tank is three-quarters full at this stage – you’re confidently approaching your destination with evidence.

Certain: Full Tank

Finally, “certain” means there is no reasonable doubt about the suspect’s involvement. This level of certainty in DFIR is achieved through comprehensive evidence that leaves no room for alternative explanations. For example, exclusive access credentials, sole access to the device, direct witness testimony, and a detailed chain of custody for all digital evidence can place the suspect firmly behind the keyboard. This is like having a full gas tank – you’re ready to reach your destination with complete assurance.

Filling Your Gas Tank in DFIR

In DFIR investigations, filling your gas tank with certainty requires a combination of technical skills, thorough analysis, corroborative evidence, and the ability to put individual pieces of evidence and artifacts into a complete picture.

Each piece of evidence is a drop of fuel, contributing to the overall confidence in your attribution. By understanding and applying these levels of certainty, you can more accurately communicate findings and ensure that conclusions are well-supported and defensible. Consider that a single forensic artifact is circumstantial evidence. A second artifact is also circumstantial evidence.  Then a third..then a fourth…then as the circumstantial evidence supports an investigative theory as a whole, you have a good case.

The goal is to build a comprehensive and compelling case that moves from possibility to certainty, ensuring that justice is served and the right individuals are held accountable. As you discover one artifact after another, think of them as drops of gas in a tank that you need to fill up before submitting your case.

The value of your opinion and belief

I am always surprised to see cases that are light on evidence and heavy on assumptions and beliefs. An investigator’s belief or opinion is as valuable as a peanut butter and jelly sandwich that sat in your locker for a month. Before you start your victory dance after finding key artifacts, you need to first corroborate, validate, and verify them.  Think totality of the evidence and how each piece fits in the big picture.

So, how full is your gas tank in your current investigations?  FILL IT UP!