2.12 Interrogating the Data

As previously mentioned, it is recommended that any analysis start with a sampling of all the data that will eventually be used for the construction of a model or profile. Data mining is exploratory by its very nature in that it is not a process of creating reports. The analyst is commonly searching for clues, ratios, attributes, patterns, characteristics, features, trends, and other telltale intelligence stored in large databases.

The process is iterative, leading to correlations and insights often leading to further mining. Once a particular area or finding is discovered, additional information may be required to confirm a hypothesis. Data mining is an interactive process that often leads to more interesting findings. As we mentioned in Chapter 1, it is very much like the process of criminal profiling, requiring some heuristics skills. It is not an exact science. One of the key items to consider during the data interrogation process is documenting how it was conducted. The process may need to be duplicated by other investigators or analysts. In addition, as with other forensic analyses and findings, the results may end up in court.