Chapter 6 — Calculus II
Lesson map
Lesson 06 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Exponential growth"]
N2["6.2 Backlog as a differential equation"]
N3["6.3 Decay"]
N4["6.4 Series"]
N5["6.5 Fitting and checking"]
N6["6.6 Communicating models"]
N7["Sensitivity analysis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Exponential growth"]
N2["6.2 Backlog as a differential equation"]
N3["6.3 Decay"]
N4["6.4 Series"]
N5["6.5 Fitting and checking"]
N6["6.6 Communicating models"]
N7["Sensitivity analysis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[6.1 Exponential growth]
|
v
[6.2 Backlog as a differential equation]
|
v
[6.3 Decay]
|
v
[6.4 Series]
|
v
[6.5 Fitting and checking]
|
v
[6.6 Communicating models]
|
v
[Sensitivity analysis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) use exponential models for growth and decay; (2) model backlog growth; (3) use series to estimate totals; (4) judge when models mislead.
6.1 Exponential growth
Garfinkel (2010) described rapidly growing storage volumes as a central problem for digital forensics. If average seized storage doubles every few years, it follows S(t) = S0 · 2^(t/T). Priya fits T from Northfield's synthetic records.
Taking logarithms turns the curve into a straight line: log2 S = log2 S0 + t/T, so T is the reciprocal of the slope when log storage is plotted against years. Priya's synthetic records give a slope of about one third per year, which means a doubling time of three years. That figure is a planning assumption for storage purchases, not a law of nature, and she labels it that way.
6.2 Backlog as a differential equation
If cases arrive at rate a and are completed at rate c, backlog B changes as dB/dt = a − c. When a exceeds c, backlog grows without limit; only more capacity or less work per case stops it.
Suppose Northfield receives 45 cases a month and completes 40. The backlog grows by five a month regardless of how hard anyone works on a given day. Overtime raises c temporarily, but once it ends the growth resumes. Priya shows managers the simple line B(t) = B0 + (a − c)t next to the real backlog figures, and the close fit makes the argument for structural change better than any anecdote.
6.3 Decay
Some artefacts are overwritten over time. If a log rotates and keeps a fixed number of entries, the chance an old event survives falls as new events arrive — roughly exponential decay in practice.
For a log that keeps the last N entries and receives events at rate r, an entry written at time zero is overwritten after about N/r time units, so survival there is a cliff rather than a slope. Exponential decay is a better description where overwriting is random, as with unallocated clusters reused by a busy file system. Priya keeps the two cases apart because they lead to different advice about how quickly to collect.
6.4 Series
Summing a geometric series estimates total storage over several years of seizures: S0(1 + r + r² + …).
For growth factor r per year, the sum over n years is S0(rⁿ − 1)/(r − 1). With S0 = 200 TB in the first year and r = 1.3, five years of intake comes to roughly 1,800 TB, not 1,000. The formula is useful mainly as a reality check on budget proposals that assume flat intake. Priya adds retention policy to the calculation, because storage stops accumulating once old cases are released.
6.5 Fitting and checking
Fit models on past data, then check them on a later year not used for fitting.
Holding out the most recent year is the honest test, because that is the kind of prediction the lab actually needs. If the fitted doubling time predicted 640 TB for the held-out year and the real figure was 590 TB, the error is about eight percent, and that error band goes into the forecast. A model checked only on the data used to fit it will always look better than it is.
6.6 Communicating models
Hugo wants one sentence for management: what the model predicts, under what assumptions, and how wrong it might be.
Priya's sentence reads: 'If seized storage keeps growing at the rate seen over the last six years, we will need about 1.8 PB of capacity within five years; on last year's check, the model was off by about eight percent.' It names the assumption, the prediction and the error, and it leaves the purchasing decision to the people who own the budget.
Sensitivity analysis
Priya varies each model input in turn — doubling time, arrival rate, completion rate — to see which assumption changes the forecast most. Completion rate dominates, so she advises the lab that measuring it carefully matters more than refining the storage trend. The table of variations goes into her appendix.
Worked example
Northfield's synthetic data: average 0.5 TB per case in year 0, 1 TB in year 3. Doubling time T = 3 years. If the lab completes 40 cases a month and receives 45, backlog grows by 5 cases a month even before larger drives slow work further. Priya's sentence: "If trends continue, backlog grows about 60 cases a year; this assumes stable intake and staffing."
Synthetic case. The figures are invented.
Errors and limits
Exponential trends cannot continue forever; use them for short horizons and revisit them yearly.
Exercises
- EX016 — Backlog sign. With 45 arrivals and 40 completions a month, what happens to backlog? Rubric: 3 = grows 5/month, 60/year; 2 = grows; 1 = shrinks; 0 = none.
- EX017 — Doubling time. From 0.5 TB to 1 TB in three years, what is T? Rubric: 3 = 3 years with reason; 2 = number; 1 = wrong; 0 = none.
- EX018 — Model sentence. What three parts should the management sentence contain? Rubric: 3 = prediction, assumptions, uncertainty; 2 = two; 1 = one; 0 = none.
Synthesis
Growth and decay models help plan forensic capacity when their assumptions are stated and checked.
Continue studying — chapter 06 of 50
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →