Wednesday, October 18, 2006
Deductive and Inductive reasoning
One thing that I see on a fairly regular basis is confusion between deductive and inductive reasoning. Both types of reasoning play different roles in investigations/forensics/science/etc. The difference between the two is sometimes hard to define. Here are two common defintions:
1. With deductive reasoning, the conclusions are contained, whether explicit or implicit, in the premises. With inductive reasoning, the conclusions go beyond what is contained in the premises.
2. The conclusions arrived at using (correct) deductive logic are necessarily true, meaning they must be true. The conclusions arrived at using inductive logic, are not necessarily true, although they may be.
An example might clarify things (taken from a philosophy class I took years ago):
In this case, since I studied, I got an A on the exam. The conclusion (I got an A on the exam) is contained implicitly in 1 and 2. For the geeks in us, here is a proof:
With inductive reasoning however:
Just because I got an A on the exam doesn't imply I studied, I could have cheated. For the geeks in us, here is an (incorrect) proof:
The key in these examples in is parts 1 and 2. With deductive reasoning we had B and followed the If chain [(IF B then C) ^ B yields C]. With the inductive reasoning we have no B. In terms of logic this is confusing an "if" statement with an "if and only if", where the former requires one direction of truth and the latter requires two directions of truth.
So how does this play into investigations/forensics/etc.? The idea is to be careful the the conclusions drawn. For instance, (relating back to the blog post about context) if an examiner finds the string "hacker" on a hard disk, the hit doesn't necessarily mean that a "hacker" was on the system, nor does it necessarily mean that "hacker" tools were used. The data around the string would (hopefully) provide more context. Although even the presence of "hacker" tools doesn't mean that the suspect actually used them, nor does it necessarily mean that the suspect even introduced them to the system. These types of questions are often raised with "The Trojan Defense".
One (common) misunderstanding of deductive and inductive reasoning is with our legal system. Our legal system depends heavily on inductive reasoning (inferences). For instance take the case with Keith Jones testifying at the UBS trial. Keith Jones testified about what was found on UBS systems, various different sources of logs (e.g. WTMP logs, provider logs, etc.) and his analysis of the information. Does this prove with 100% certainty that the suspect (Duronio) actually committed the crime? No it doesn't. However with a substantial amount of evidence, a jury could reach the conclusion that the standard of "beyond a reasonable doubt" has been met.
Another example of deductive vs. inductive reasoning is with "courts approving digital forensic tools". First courts aren't in the business of approving digital forensics tools. They may allow a person to testify about the use and conclusions drawn using the tools. This is fundamentally different from saying "tool XYZ is approved by this court". The reasoning for allowing an examiner to testify using the results obtained from a tool typically involves a trusted third party. Essentially one (or more) third parties comes to a conclusion about the correctness of a tool. So the decision about allowing the original examiner to testify about the results found using the tool depends on what a third party thinks. This leads to the question: Just because a third party thinks so, does it mean it's guaranteed to be true? Perhaps yes, perhaps no. [Note: I'm not commenting about any specific digital forensics tool, this could apply to any situation involving any type of tool or even process. This is one type of review used when considering whether or not to allow a scientific tool/process/technique into court.]
1. With deductive reasoning, the conclusions are contained, whether explicit or implicit, in the premises. With inductive reasoning, the conclusions go beyond what is contained in the premises.
2. The conclusions arrived at using (correct) deductive logic are necessarily true, meaning they must be true. The conclusions arrived at using inductive logic, are not necessarily true, although they may be.
An example might clarify things (taken from a philosophy class I took years ago):
- If I study, I will get an A on the exam (premise)
- I studied (premise)
- Therefore I got an A on the exam (conclusion)
In this case, since I studied, I got an A on the exam. The conclusion (I got an A on the exam) is contained implicitly in 1 and 2. For the geeks in us, here is a proof:
- If I study, then I will get an A on the exam [ IF A then B ]
- I studied [ A ]
- Therefore I got an A on the exam [ B ] (modus ponens on 1 and 2)
With inductive reasoning however:
- If I study, then I will get an A on the exam (premise)
- I got an A on the exam (premise)
- Therefore I studied (conclusion)
Just because I got an A on the exam doesn't imply I studied, I could have cheated. For the geeks in us, here is an (incorrect) proof:
- If I study, then I will get an A on the exam [ IF B then C ]
- I got an A on the exam [ C ]
- Therefore I studied (no logical argument, no B)
The key in these examples in is parts 1 and 2. With deductive reasoning we had B and followed the If chain [(IF B then C) ^ B yields C]. With the inductive reasoning we have no B. In terms of logic this is confusing an "if" statement with an "if and only if", where the former requires one direction of truth and the latter requires two directions of truth.
So how does this play into investigations/forensics/etc.? The idea is to be careful the the conclusions drawn. For instance, (relating back to the blog post about context) if an examiner finds the string "hacker" on a hard disk, the hit doesn't necessarily mean that a "hacker" was on the system, nor does it necessarily mean that "hacker" tools were used. The data around the string would (hopefully) provide more context. Although even the presence of "hacker" tools doesn't mean that the suspect actually used them, nor does it necessarily mean that the suspect even introduced them to the system. These types of questions are often raised with "The Trojan Defense".
One (common) misunderstanding of deductive and inductive reasoning is with our legal system. Our legal system depends heavily on inductive reasoning (inferences). For instance take the case with Keith Jones testifying at the UBS trial. Keith Jones testified about what was found on UBS systems, various different sources of logs (e.g. WTMP logs, provider logs, etc.) and his analysis of the information. Does this prove with 100% certainty that the suspect (Duronio) actually committed the crime? No it doesn't. However with a substantial amount of evidence, a jury could reach the conclusion that the standard of "beyond a reasonable doubt" has been met.
Another example of deductive vs. inductive reasoning is with "courts approving digital forensic tools". First courts aren't in the business of approving digital forensics tools. They may allow a person to testify about the use and conclusions drawn using the tools. This is fundamentally different from saying "tool XYZ is approved by this court". The reasoning for allowing an examiner to testify using the results obtained from a tool typically involves a trusted third party. Essentially one (or more) third parties comes to a conclusion about the correctness of a tool. So the decision about allowing the original examiner to testify about the results found using the tool depends on what a third party thinks. This leads to the question: Just because a third party thinks so, does it mean it's guaranteed to be true? Perhaps yes, perhaps no. [Note: I'm not commenting about any specific digital forensics tool, this could apply to any situation involving any type of tool or even process. This is one type of review used when considering whether or not to allow a scientific tool/process/technique into court.]
