What are some of the key challenges of big data when it comes to digital forensics?

One of the foremost axioms of forensics, digital or otherwise, is Locard’s exchange principle. Simply put, this principle, formulated by Dr. Edmond Locard (known in his time as “the Sherlock Holmes of France”), states:

“Every contact leaves a trace.”

These traces are the tiny pieces left behind that we forensic investigators use to help determine in a given situation what happened, where it happened, who it happened to, when it happened, how it happened and who did it.

So digital forensics is the pursuit of artifacts and traces of digital evidence: small data, not big data. Big data, as a concept, is the study of huge and complex data sets where traditional methods of analysis don’t function as well as new “big data” methodologies.

For example, AI algorithms can be used to detect patterns of usage on mobile devices and GPS to determine the microregions of wealth or poverty. This is a good example of “big data” at work.

Big data, therefore, doesn't present much of a challenge to digital forensics because it deals with smaller data sets.
 

无论是数字取证还是其他取证，最重要的公理之一是洛卡德交换原理。简而言之，这一原则由埃德蒙·洛卡尔博士（在他的时代被称为“法国的福尔摩斯”）提出，指出：

“每一次接触都会留下痕迹。”

这些痕迹是留下的微小碎片，我们法医调查人员用它们来帮助确定在特定情况下发生了什么、发生在哪里、发生在谁身上、何时发生、如何发生以及是谁干的。

因此，数字取证是追求数字证据的文物和痕迹：小数据，而不是大数据。大数据作为一个概念，是对巨大而复杂的数据集的研究，传统的分析方法无法像新的“大数据”方法那样发挥作用。

例如，人工智能 算法可用于检测移动设备和GPS的使用模式，以确定富裕或贫困的微观区域。这是“大数据”发挥作用的一个很好的例子。

因此，大数据不会对数字取证带来太大的挑战，因为它处理的是较小的数据集。