Anti-forensics
The Problem with Missing Artifacts
A missing log entry can mean nothing happened, or simply that logging was incomplete.
Read the entry →Home / Research
Index / 30 entries
Research
Evidence-led primers and open research questions in forensic methodology, cyberbiosecurity and synthetic media.
Professional forensic methodology
Acquisition, Hashes and Chain-of-Custody Boundaries
What collection logs, matching digests and custody records can establish, and what still requires independent proof.
Read the entry →Cyberbiosecurity
Agricultural OT Attack Surfaces
Digital dependencies have biological and operational consequences.
Read the entry →Investigations
AI-Generated Witness Identity Risks
Remote testimony and media files require speaker and origin verification, not only plausible presentation.
Read the entry →Cyberbiosecurity
Data Poisoning in Biosecurity Pipelines
Bad data can redirect biological decisions without changing the underlying biology.
Read the entry →Biosecurity data
Bitemporal Threat Records
An event date and the date the organization learned about it are different facts.
Read the entry →Cross-domain research methods
Evidence Boundaries Across Forensics, Biology and History
Why the same source-conscious reasoning applies across disciplines but their methods, authorities and validation standards remain different.
Read the entry →Forensic practice
Chain of Custody for Mutable Data
Digital objects can be copied perfectly while their contextual meaning changes.
Read the entry →Evidence integrity & source provenance
The Independent-Corroboration Audit: A Reproducible Review Protocol
A source-dependency worksheet and review procedure for determining whether multiple agreeing accounts represent independent observations.
Read the entry →Agricultural security
Agricultural Biosurveillance Signals
Early warning is a problem of classification, geographic context and false-positive control.
Read the entry →Anti-forensics & evidence reliability
Forensic Observability: When a Missing Record Means Less Than You Think
A practical method for testing whether an evidence gap is expected, incidental, collection-related, or genuinely unexplained.
Read the entry →Digital forensics
A Provenance-First Examination
An examiner should be able to explain where every important interpretation came from.
Read the entry →Professional forensic methodology
Design a Known-Input Forensic Validation
A bounded, falsifiable approach to testing one parser, acquisition feature or analytical assertion against inspectable ground truth.
Read the entry →Evidence methods
Why a Hash Is Not a Truth Detector
Cryptographic integrity is essential but proves less than people wish.
Read the entry →Forensic procedure
Remote Testimony Verification
A remote witness channel is both a communication channel and an authentication problem.
Read the entry →Forensic epistemology
Corroboration Matrix for Evidence Reviews
A matrix helps separate genuinely independent evidence streams.
Read the entry →Publishing systems
Licensing and Provenance in Reference Data
Publishing structured knowledge requires rights analysis in addition to technical correctness.
Read the entry →Synthetic imprinting
Source Monitoring and Artificial Experience
Human memory may retain content while losing certainty about its origin.
Read the entry →Embedded sensors
Radar Detection Is Not Identity
A motion return is not a person, and presence is not intent.
Read the entry →Biosurveillance
Attribution Pitfalls in Outbreak Reporting
A confirmed case is not proof of the path by which it spread.
Read the entry →Security engineering
Threat Models for Public Research Archives
A public archive is a target for tampering, stale data and misleading citation reuse.
Read the entry →Professional research governance
Research Transparency, Versions and Corrections
Publish source ancestry, methods, uncertainty and corrections so subsequent readers can distinguish a revised interpretation from changed evidence.
Read the entry →AI governance
Semantic Drift in Investigative Summaries
An assistant can preserve the grammar of a claim while subtly shifting its strength.
Read the entry →Evidence methods
Source Independence as a Test
Evidence weight depends on causal independence, not the number of documents.
Read the entry →Cyberbiosecurity
Software Supply Chains in Biological Facilities
Laboratory and farm systems inherit security risk from vendors, libraries and support pathways.
Read the entry →Research design
How to Test Synthetic Imprinting
A testable framework needs operational definitions and measurable outcomes.
Read the entry →Media forensics
Synthetic Media Triage
Detection scores should be treated as conditional measurements, not verdicts.
Read the entry →Digital forensics
Synthetic Timeline Contamination
A timeline can be internally consistent and still be assembled from manipulated or derivative timestamps.
Read the entry →Forensic epistemology
The Perfectly Corroborated Lie
Agreement between records is not equivalent to independent corroboration.
Read the entry →Research methods
Building an Uncertainty Register
Explicit unknowns are an asset in high-stakes research.
Read the entry →