Thread by @chrissanders88

One of the unique challenges of forensic analysis is that we're focused both on determining what events happened and the disposition of those events (benign or malicious). A failure to do one well can lead to mistakes with the other. 1/

Generally speaking, analysts interpret evidence to look for cues that spawn more investigative actions. Those cues can be relational (indicate the presence of related events), dispositional (indicate the malicious or benign nature of something), or even both at the same time. 2/

Not only do we have to explore relationships, but we also have to characterize and conceptualize them. That means we're constantly switching between cause/effect analysis and pattern matching of a variety of sorts. 3/

We're rarely at a shortage of relationships to investigate, but the dispositional cues help give us a sense of priority. We investigate the relationships that are more likely to be malicious. 4/

There's the potential to fall into the trap of a cascade effect here. Once you decide one event is malicious, you inherently decide everything associated with it (cause or effect) is also malicious. The opposite is also true, but sometimes to a lesser extent. 5/

That's to say we are more likely to associate guilt than we are to absolve it and let things off the hook, from my research. Some variables at play there... 6/

With all this, it means that if you misdispose something as benign, you overlook the whole chain of events. If you misdispose as malicious, you waste a lot of time. Trust and time are the most critical and non replenishable resources the analyst has. 7/

Cognitively, I'm seeing some evidence that analysts who are more aware of this consideration -- relational vs dispositional cues -- have greater success making decisions and efficiently using their time. 8/

I've talked about the concept of gravity before...how some findings in an investigation "pull" analysts toward them. The more analysts acknowledge dispositions consciously, the more control they seem to have over an entity's gravity. 9/

A novice analyst gets sucked into investigating an IP on any level of suspicion it's evil. An expert recognizes some probability it's evil and uses that to determine how much time they should spend on it. They adjust as the facts do. They are more gravitationally aware. 10/

As with many things happening between our ears, there is some nuance here that's hard to capture on Twitter. But as always, being a good analyst is hard. We can make it easier by better understanding some of these processes and the steps along the path to expertise. 11/11