Uncertainty-aware analysis of digital traces: probabilistic methods in forensic computing

• Applicant: Dr.-Ing. Jan Gruber
• Subject Area: Security and Dependability, Operating-, Communication- and Distributed Systems
• Term: since 2025
• Project identifier: Deutsche Forschungsgemeinschaft (DFG) - Project number 570978749

The ongoing digitalization is permeating all areas of society. Accordingly, criminal phenomena are increasingly shifting to the digital domain, and digital evidence is also playing an increasingly important role in the investigation of traditional crimes. These general developments are leading to a growing significance of cyber-criminalistics, which in turn draws upon the methods and insights of forensic computing. In this field, issues concerning the quantity and complexity of digital traces were recognized at an early stage. It is often unclear which traces are relevant for addressing investigative questions and for reconstructing past events. While a broad line of research pursues practical-experimental or empirical approaches to enable meaningful interpretation of digital traces, previous work - including our own - has shown that the use of formal methods holds great potential for the identification and analysis of such traces. One aspect that has so far been largely neglected is the understanding and quantification of system-inherent uncertainties in the course of analysis. Since it can be assumed that the precision of trace interpretation can be significantly improved by accounting for these uncertainties, this project aims to establish foundational methods for model-based interpretation of digital traces in probabilistic environments - a practice already well established in classical forensic sciences through the use of Bayesian methods. Accordingly, the goal is to develop a systematic and formally specified method that captures and describes existing uncertainties. This will enable the universal generation of concrete probabilistic models for individual digital traces. The project is intended to contribute to strengthening forensic computing by deliberately accounting for and quantifying uncertainties and error probabilities, and to support its establishment as a recognized subdiscipline within the forensic sciences.

• DFG Programme: WBP Position