We consider the forensic context in which the goal is to assess whether two sets of observed data came from the same source or from different sources. In particular, we focus on the situation in which the evidence consists of two sets of categorical count data: a set of event counts from an unknown source tied to a crime and a set of event counts generated by a known source. Using a same-source versus different-source hypothesis framework, we develop an approach to calculating a likelihood ratio. Under our proposed model, the likelihood ratio can be calculated in closed form, and we use this to theoretically analyse how the likelihood ratio is affected by how much data is observed, the number of event types being considered, and the prior used in the Bayesian model. Our work is motivated in particular by user-generated event data in digital forensics, a context in which relatively few statistical methodologies have yet been developed to support quantitative analysis of event data after it is extracted from a device. We evaluate our proposed method through experiments using three real-world event datasets, representing a variety of event types that may arise in digital forensics. The results of the theoretical analyses and experiments with real-world datasets demonstrate that while this model is a useful starting point for the statistical forensic analysis of user-generated event data, more work is needed before it can be applied for practical use.
Likelihood ratios for categorical count data with applications in digital forensics

Journal: Law, Probability & Risk
Published: 2022
Primary Author: Rachel Longjohn
Secondary Authors: Padhraic Smyth, Hal Sten
Type: Publication
Related Resources
Significance of image brightness levels for PRNU camera identification
A forensic investigator performing source identification on a questioned image from a crime aims to identify the unknown camera that acquired the image. On the camera sensor, minute spatial variations…
Methodological problems in every black-box study of forensic firearm comparisons
Reviews conducted by the National Academy of Sciences (2009) and the President’s Council of Advisors on Science and Technology (2016) concluded that the field of forensic firearm comparisons has not…
First impressions matter: Mundane obstacles to a forensic device for probabilistic reporting in fingerprint analysis
This article investigates why statistical reasoning has had little impact on the practice of friction ridge (or ‘fingerprint’) examination, despite both interest and some modest scientific progress toward this goal.…
A Dirichlet process model for directional-linear data with application to bloodstain pattern analysis
Directional data require specialized models because of the non-Euclidean nature of their domain. When a directional variable is observed jointly with linear variables, modeling their dependence adds an additional layer…