how to track an examiner and how they work?

I did some work similar to this for my undergraduate dissertation (although it involved SOCO's). My preference was to observe them in a manner that provided minimal interference to their functioning. If you can find a way to observe them with them barely knowing you are there (obviously they are informed and agree to it first!) then you will get the best results. I did some SOCO observations using a crime scene training house and a CCTV system.

This might be a bit extreme, so perhaps a simple webcam mounted behind them that can see both them and their computer screen, and one with audio capabilities so you can watch and listen to them live. I certainly wouldn't rule out the value of them speaking aloud occasionally when they find something interesting. Plus make sure to get a camera with high resolution capabilities!

Alternatively you could just sit slightly behind them and make notes, keeping quiet so as to not distract them.

Hope this helps

Ben

thanks Ben, this could be a method that I use in the end. I was hoping that I could somehow monitor them via computer software of some description asI really want to create a set of stat from where they look and I hoped that it wouldnt involve me taking a lot of notes or reviewing video footage (I might be being a little lazy here). In the end I want to see if i can work out how successful the examiner would be at finding evidence compared to automated scripts

My thought is your best bet is to video capture their screen along with an audio commentary. It may not be the most fun reviewing the video but that is the examination. There is no better way to see how an examiner functions and operates than to watch him work.

If you dont want to do this, then sit next to them an ask questions until your blue in the face… or you get smacked.

I think you guys are right, however let me put this to you. What about having a little note taking piece of software in the background that records the following

None evidential area (Base Path)
Evidenctial areas (base path)
Evidential file path (to actual file)
Relevant key words (terms, software names etc)

If the examiner pastes their paths from encase or whatever software they use into the program all the details can be recorded for the exam. I think these 4 sections should cover quite a large amount of the exam and what they look for and do. I dont think this would be too intrusive for just 1 test? any thoughts?

thanks Ben, this could be a method that I use in the end. I was hoping that I could somehow monitor them via computer software of some description asI really want to create a set of stat from where they look and I hoped that it wouldnt involve me taking a lot of notes or reviewing video footage (I might be being a little lazy here). In the end I want to see if i can work out how successful the examiner would be at finding evidence compared to automated scripts

There are multiple things that pop out to me here.

1) Your objective is to create a set of stats to be able to trend an examiners behavior. But are you basing these stats on one examiner? Two? Two hundred? Or the entire CCE Certified list? You’re not going to get a fair or reasonable assessment by watching one person, department, or organization. Each examiner has their own methodology and their own style. Automated tools run in the fashion and order that they are programmed to run. Humans program themselves based on experience or what the case requires. An automated tool/script will have one set function, thus you would need another tool/script for every function or process you wanted to perform. An examiner can begin the examination, find a piece of evidence or information and use that to alter their methodology and approach to the rest of the examination.

2) You say and I quote

I hoped that it wouldn’t involve me taking a lot of notes or reviewing video footage (I might be being a little lazy here).

A little lazy? That’s all you’ll give yourself? This is epicly lazy, it seems what you would optimally want is to get the data you’re looking for handed to you. Do some due diligence and actually put some effort in. Why wouldn’t you want to observe an examiner in any fashion possible? I’d sit in on any investigation if I could learn one thing each time. You’re never going to know all that an examiner is thinking/hypothesizing/speculating unless you sit with them many many times.

3) You also may want to make sure that the cases you are sitting in on, or whatever you decide to do, are not privileged or that you have the proper authority/rights to be viewing the information as well.
Good luck! I would like to hear your results.

I think you guys are right, however let me put this to you. What about having a little note taking piece of software in the background that records the following

None evidential area (Base Path)
Evidenctial areas (base path)
Evidential file path (to actual file)
Relevant key words (terms, software names etc)

If the examiner pastes their paths from encase or whatever software they use into the program all the details can be recorded for the exam. I think these 4 sections should cover quite a large amount of the exam and what they look for and do. I dont think this would be too intrusive for just 1 test? any thoughts?

It's a possibility, however there is much to be said for the 'human' factor. A little bit of disturbance and commentary will probably aid you far more than you anticipate.

I know from doing my SOCO observations that there were occasions where I was left thinking "What have they just done that for?!?". Without interaction being possible, and the ability to ask them some questions, I would not have been able to get an answer to some puzzling actions taken.

A computer program doing auto logging is a great start, but it can only get you so far. Plus, if something unexpected occurs during the course of their investigation, they may have to deviate away from planned strategies, which your software will not necessarily be able to account for, or explain.

Perhaps consider doing both to get the best of both worlds!

muirner - sorry i may have made a bad impression here, i will put the effort in my laziness will be sorted! I want to base my examinations on multiple examiner as many as i can get. In fact if I could get some sort of recording tool sorted my aim would be to pass out a standard examination to anyone who would like to take part in my trial which I would like to advertise on here at a later date hence my reason for a more software based method as i know I cant attend every investigation. Alternatively I might try and focus on 1 type of examiner, fraud etc. The more examiners taking part the stronger the research will become as I will learn from multiple methods and approaches. And yes a lot will depend on the authorities allowing such things to take place and I will be looking into such stumbling blocks.

Ben - I agree it could well be the best of both worlds by approaching it using both methods

tooty - That's the attitude i like to hear )! Let me explain why i gave you a little crap. It is shown that someone who wants to excell and is driven to know more, learn more and work harder will excell further. I understand it's going to be a decent amount of work but, your results will be that much more valid. Thus any paper or report you give will have that much more validity.

I think that you have a good goal, focusing on one examiner type. Though here in the sates while some examiners have specialities there are many that will do anything forensics related. One idea i have is using a program like Camtasia and having the examiners comentary recoreded into the video. Have them detail their thought process outloud if possible.

My last thought is the material you have someone examining. If you could find a standard testing image for everyone to use it would help to prevent case details and goals from causing examinations to vary wildly. Yur attitude in your last post is much better and I'm anxious to see how this continues forward.

haha im excited about this too and I have some, what i think to be some very good and exciting ideas however i am a little hesitant to display them to the world at present as it is for a thesis I am writing! A standard image would give me advantages and disadvantages. Ideally everyone should find the same evidence therefore results in theory should be similar. Bad points are that different evidence (yet involved in same crime) may have different artefacts which may give me a wider set of data from all the examiners involved. I would like to collate all data from the examiners and put it together in one big library. A theory is that are 100 examiners better than 1. Could 100 recorded examinations find more data going into an examination blind, than a triage tool operated by 1 examiner. Possibly