Chapter 1 — Calculus I
Lesson map
Lesson 01 published. Map, example, EX001.
flowchart TD
N0["Learning outcomes"]
N1["1.1 Why an engineer in forensics needs calculus"]
N2["1.2 Rate of change"]
N3["1.3 Reading slopes from logs"]
N4["1.4 Integrals as totals"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX001"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["1.1 Why an engineer in forensics needs calculus"]
N2["1.2 Rate of change"]
N3["1.3 Reading slopes from logs"]
N4["1.4 Integrals as totals"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX001"]
[Learning outcomes]
|
v
[1.1 Why an engineer in forensics needs calculus]
|
v
[1.2 Rate of change]
|
v
[1.3 Reading slopes from logs]
|
v
[1.4 Integrals as totals]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX001]
Learning outcomes
You will (1) use rates of change to describe forensic processes; (2) read derivatives from data; (3) estimate imaging time from a rate; (4) recognise where calculus models break down.
1.1 Why an engineer in forensics needs calculus
Priya Nandakumar is a first-year engineering student at the fictional Kestrel Institute of Technology. Her five-year track ends with a capstone for the fictional Northfield Regional Forensic Lab, where examiner Hugo Brandt mentors students. Hugo's first remark: forensic labs are queues of data moving at rates. Rates are derivatives.
A lab receives drives, images them, indexes them and examines them, and each stage has an input rate and an output rate. When Priya asks why a case waited three weeks, the honest answer is usually that one stage ran slower than the stage feeding it. Calculus gives her a precise language for that mismatch and a way to estimate how long the queue will take to drain.
1.2 Rate of change
If a drive image grows by d(t) gigabytes after t minutes, the derivative d′(t) is the imaging speed. A constant derivative means steady throughput; a falling derivative can signal a failing drive with many retries — something examiners note because NIST SP 800-86 expects the acquisition process to be documented, including problems encountered.
Priya plots d(t) for a healthy synthetic drive and for one with a damaged region. The healthy curve is nearly a straight line. The damaged one flattens for several minutes, then recovers, and the flat stretch lines up with a burst of read-retry messages in the imaging log. Recording the start and end of that flattening, and the sectors involved, turns a vague 'imaging was slow' into an observation another examiner can check.
1.3 Reading slopes from logs
Imaging tools log bytes copied over time. The slope between two log points approximates the derivative: 60 GB at minute 10 and 120 GB at minute 20 gives 6 GB per minute.
Short intervals give a local slope; long intervals average over trouble and hide it. Between minutes 10 and 20 the average is 6 GB per minute, but the log may show 7.5 GB per minute for eight minutes and almost nothing for two. Priya therefore computes slopes over one-minute windows and flags any window that falls below half the median rate, which is a simple, repeatable way to locate problem regions.
1.4 Integrals as totals
Integrating the speed over time gives total bytes copied. If speed drops in bad regions, the area under the curve shows how much was recovered by each time.
With logged points rather than a formula, the integral becomes a sum of trapezoids: average the speed at the two ends of each interval and multiply by the interval length. Priya checks her sum against the byte count the imaging tool reports at the end. If the two disagree by more than rounding, either the log missed intervals or the tool's final count needs explaining, and both possibilities go in her notes.
1.5 Limits of the model
Real throughput is stepwise and noisy; a smooth function is an approximation useful for planning, not a description of every second.
A smooth curve also cannot represent a pause while an examiner swaps a write blocker, or a burst when the tool skips an unreadable region. Priya therefore uses the model to answer planning questions, such as how many drives a station can image overnight. For an individual acquisition she relies on the tool's own log, not on the curve.
Worked example
A log shows 0 GB at 0 min, 90 GB at 10 min, 150 GB at 20 min and 165 GB at 30 min. Slopes: 9, 6, then 1.5 GB/min. The steep fall suggests read errors in a region. Priya flags it for the examiner rather than concluding the drive is damaged; a busy USB bus can cause the same pattern.
Synthetic case. Priya, Kestrel, Northfield and the log are invented.
Errors and limits
A slope between sparse points hides short stalls; sample often enough to see what matters.
Exercises
- EX001 — Imaging slope. A log reads 40 GB at 5 min and 100 GB at 15 min. What is the average speed? Rubric: 3 = 6 GB/min with working; 2 = right number only; 1 = wrong units; 0 = none.
- EX002 — Falling derivative. Give two explanations for a falling imaging rate. Rubric: 3 = drive read errors/retries and bus or host contention; 2 = one; 1 = vague; 0 = none.
- EX003 — Area meaning. What does the area under a speed–time curve represent? Rubric: 3 = total data copied; 2 = partial; 1 = speed; 0 = none.
Synthesis
Derivatives describe throughput, integrals totals, and both help plan and explain acquisitions — as approximations.