In forensic and analytical work, thinking is not enough. You must build a testable chain between your ideas and the evidence.
The core loop
- Observe — Notice something unusual, missing, or suspicious.
- Question — Turn the observation into a precise question.
- Hypothesize — Generate multiple explanations, not just one.
- Operationalize — Convert each hypothesis into a specific query or test.
- Test — Run the query against evidence.
- Evaluate — Did the evidence support, refute, or stay silent on the hypothesis?
- Revise — Update or discard hypotheses based on the result.
- Repeat — New evidence leads to new questions.
The most important additions
Hypotheses must be falsifiable
A good hypothesis is one that can be proven wrong. If your explanation fits every possible outcome, it explains nothing.
“The log was deleted by an attacker” is falsifiable if you can check for backup copies, file system artifacts, or alternative deletion causes.
“Something weird happened” is not falsifiable.
Ask questions that can be answered by evidence
Bad question: “Is this user malicious?”
Good question: “Did this user run PowerShell with encoded commands after hours?”
The second version tells you exactly what evidence to look for and what would count as an answer.
Hold multiple hypotheses at once
Do not fall in love with one explanation. The strongest investigation compares competing explanations against the same evidence.
| Hypothesis | Evidence for | Evidence against | Status |
|---|---|---|---|
| Malicious deletion | Log gap, deleted shadow copy | No remote access evidence | Unconfirmed |
| System cleanup tool | Known cleanup script present | Tool logs missing | Weak support |
| Log rotation policy | Policy exists | Gap is too large | Possible |
Negative space is evidence
What you looked for and did not find matters just as much as what you found. Document your null results. They protect you from confirmation bias and show the boundaries of your conclusion.
Beware confirmation bias
You will naturally look for evidence that supports your favorite theory. Force yourself to also ask: “What evidence would prove me wrong?” Then go look for it.
Calibrate confidence by evidence strength
Do not say “This proves X” when the evidence only makes X plausible. Use language that matches the strength of your findings:
- Direct Evidence → strongly supports
- Circumstantial Evidence → consistent with
- No evidence → cannot confirm or exclude
- Contradictory evidence → refutes
Separate what happened from what you can prove
An investigator must live with two truths:
- What actually happened may not be knowable.
- What you can demonstrate with evidence is what matters in a report, court, or remediation.
The trap to avoid
Never let your question become: “How can I prove I am right?”
The right question is: “What would the evidence look like if each hypothesis were true?”