Follow the trace Evaluating physical and digital forensic findings given activity level propositions using Bayesian networks

Forensic scientists face questions ranging from “What is the source of
this trace?” to more complex issues like “Who did what, when, where,
and how?” These latter questions, known as “activity level questions,”
become particularly challenging when they involve multiple types of
traces, such as DNA traces and fibers. Evaluating the combined strength
of evidence in these cases provides great value to the court but requires
managing numerous probabilities arising from various uncertainties. Such
complex casework requires structured probabilistic reasoning, and Bayesian
networks prove to be valuable tools for this purpose.
By using fictive case examples throughout this work, we advocate the
benefits of the LR framework and Bayesian networks for evaluating forensic
findings given activity level propositions across various disciplines—
including digital forensic science.
The result? A collection of “building blocks” representing general
probabilistic forensic problems and two template Bayesian networks
applicable to both mono- and interdisciplinary casework that map pathways
from alleged activities to traces found on items of interest (i.e., “Follow the
trace”). Additionally, two use cases in digital forensic science are presented:
one involving iPhone Health app data and another addressing Trojan horse
defense cases.
This work aims to serve as a valuable reference for forensic scientists in
their casework and research while also providing useful insights for other
professionals in the forensic and legal fields.