Chapter 1 — Mathematical reasoning
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Numbers in forensic work"]
N2["1.2 Summaries"]
N3["Lab — mean versus median"]
N4["1.3 Reading the result"]
N5["1.4 Precise statements"]
N6["1.5 Logic"]
N7["1.6 Units"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Numbers in forensic work"]
N2["1.2 Summaries"]
N3["Lab — mean versus median"]
N4["1.3 Reading the result"]
N5["1.4 Precise statements"]
N6["1.5 Logic"]
N7["1.6 Units"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Numbers in forensic work]
|
v
[1.2 Summaries]
|
v
[Lab — mean versus median]
|
v
[1.3 Reading the result]
|
v
[1.4 Precise statements]
|
v
[1.5 Logic]
|
v
[1.6 Units]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) reason carefully with numbers drawn from evidence; (2) choose between mean and median; (3) spot outliers that distort summaries; (4) state numerical claims precisely.
1.1 Numbers in forensic work
Leah Moreau begins a four-year bachelor's degree at the fictional Harrowgate University. Her lecturer, Dr Samuel Ferreira, opens with a claim: most mistakes in forensic reports are not technical but arithmetic and logical — a wrong average, an unjustified "most", a percentage without a count.
His point is practical. A report that says "most logons came from abroad" invites the question: how many, out of how many? A reader who cannot recompute a figure cannot test it, and in a dispute the opposing expert will. Throughout the course, every number Leah reports must come with the count behind it.
1.2 Summaries
A user folder has ten files. The mean (sum divided by count) and the median (the middle value when sorted) both summarise "typical" size, but they behave differently when one value is extreme.
The mean uses every value, so one huge value pulls it far from the rest. The median depends only on order, so it barely moves. Which to report depends on the question: total disk use needs the sum, while "what does a typical file in this folder look like?" needs the median. The lab uses ten synthetic sizes to make the difference visible.
Lab — mean versus median
"""Mean vs median of synthetic file sizes in a user folder (KB)."""
import statistics as st
sizes = [12, 15, 9, 22, 18, 14, 11, 16, 13, 4_200_000]
print("files:", len(sizes))
print("mean KB:", round(st.mean(sizes)))
print("median KB:", st.median(sizes))
print("mean without largest:", round(st.mean(sizes[:-1]), 1))
Run with python3 lab_sizes.py. Verified output:
files: 10
mean KB: 420013
median KB: 14.5
mean without largest: 14.4
1.3 Reading the result
Nine small files of 9–22 KB and one 4.2 GB video give a mean of 420,013 KB — a "typical" file of 420 MB that does not exist. The median, 14.5 KB, describes the folder far better. Removing the outlier gives a mean of 14.4 KB. The outlier is itself interesting evidence; the summary should not hide it.
The gap between mean and median is itself a warning sign: when they differ by a factor of thousands, look for the value causing it. Here the culprit is the single video, and naming it lets a reader confirm that it belongs in the folder at all.
1.4 Precise statements
"Most files were small" becomes "nine of ten files were under 25 KB; one was 4.2 GB." Counts let readers check the claim.
The precise version also names a threshold, 25 KB, so a reader knows what "small" meant. It reports the outlier separately rather than folding it into a vague majority. In the ws-114 investigation, Leah applies the same rule to logon counts and file lists: each claim states the number found, the total examined and where the data came from, so the security office can reproduce it.
1.5 Logic
"All executables in Downloads were flagged; update.dll is in Downloads; therefore update.dll was flagged" is valid only if the first premise is true. Examiners check premises, not just form.
In the example, the premise came from a scanner's summary page. If the scanner skipped files over a size limit, or was run before update.dll arrived, the premise is false and the conclusion fails despite the valid form. Leah checks the scanner's log for the file's name and scan time before writing the sentence, which turns an inference into a direct observation.
1.6 Units
Kilobytes may mean 1,000 or 1,024 bytes; state which.
The difference grows with size: a kibibyte is 2.4% larger than a kilobyte, but a tebibyte is about 10% larger than a terabyte. A disk sold as 500 GB shows as about 466 GiB in many operating systems, which has led to false claims that data were missing. Leah writes units in full the first time, such as "4.2 GB (decimal)", and keeps one convention throughout the report. The lab's figures are decimal kilobytes, so the 4.2 GB video is 4,200,000 KB.
1.7 Estimation
Quick order-of-magnitude checks catch errors: if a report says a 500 GB disk was imaged in five minutes, the implied speed is implausible.
Five minutes is 300 seconds, so 500 GB would need about 1.7 GB per second sustained, faster than most write-blocked imaging setups achieve. The estimate does not prove the report wrong, but it tells the reviewer to check the imaging log: perhaps only part of the disk was imaged, or the time was recorded incorrectly. A ten-second calculation finds questions that a careful read of the prose might miss.
Worked example
A draft report says "average file size in the folder was 420 MB". Leah rewrites: "Median file size was 14.5 KB (10 files); one file, a 4.2 GB video, dominates the mean." Dr Ferreira adds: name the outlier file so readers can find it.
Synthetic case. Leah, Harrowgate and the folder are invented.
Errors and limits
The median ignores how extreme outliers are; report both, with counts, when it matters.
Exercises
- EX001 — Lab summary. Report the mean and median from the lab and which is more representative. Rubric: 3 = 420,013 KB vs 14.5 KB; median, due to outlier; 2 = values only; 1 = wrong; 0 = none.
- EX002 — Precise claim. Rewrite "most files were small" precisely. Rubric: 3 = counts and thresholds; names outlier; 2 = partial; 1 = vague; 0 = none.
- EX003 — Implausible speed. Why is "500 GB imaged in five minutes" suspicious? Rubric: 3 = implies ~1.7 GB/s, beyond typical hardware; 2 = partial; 1 = fine; 0 = none.
Synthesis
Choose summaries that fit the data, give counts, name outliers and sanity-check magnitudes.