Did a suspect possibly involved in a criminal offense actually send a WhatsApp message — or was it someone else, or even something else? "In the digital age, traces are rarely unambiguous," says Harm van Beek, digital forensic investigator at the Netherlands Forensic Institute (NFI) and Professor of Digital Forensics at the Open University of the Netherlands.
On Friday, 19 September, he will deliver his inaugural lecture, “Digital Traces. Clearly Unclear”, at the Open University in Heerlen. Van Beek: “Using formal methods such as mathematical models and logic, it is possible to increase the reliability of digital traces. These formal methods are not a limitation for investigations; they offer an opportunity to make the process more precise, fair, and transparent.”
Formal Methods
Digital traces — think emails, photos, or location data — can play a decisive role in criminal cases, yet they are often ambiguous or technically challenging. To enhance their evidentiary reliability, Van Beek advocates for the use of formal methods: mathematical models and logical frameworks that help reconstruct, analyze, and assess digital scenarios. Prior to the lecture, the symposium “Digital Traces on the Scales of Justice” will take place, focusing on the significance of digital evidence and its legal context.
Formal methods are still rarely applied in (digital) forensic investigations, despite their relevance for law enforcement and courtroom proceedings. “You can compare the use of formal methods to the difference between a rough sketch and a construction drawing: the former gives a general idea, while the latter shows exactly how everything fits together.” Van Beek continues: “Formal methods help us better understand, structure, and analyze digital traces. They require us to reason precisely and transparently: What do we know for sure based on the traces? What might have happened? And what can be ruled out?”
From Data to Decisive Evidence
One practical application of these methods is constructing timelines based on digital data. Van Beek illustrates: “Police may find chat messages, photos, and log entries on your phone. These come with timestamps, some of which may be unreliable. By applying formal time models, investigators can still establish a consistent timeline. We can then say, ‘If this photo was taken after that message, then the action must have occurred between approximately 4:00 PM and 4:05 PM.’”
The Future of Digital Forensic Investigation
Such time-based analyses are essential for comparing investigative scenarios. Does a suspect's alibi hold up? Does their story align with what can be digitally reconstructed? Formal methods can make digital forensic investigations more precise, fair, and transparent. This research chair bridges the fields of computer science, information science, and law, while also connecting to real-world practice at the NFI. Van Beek: “With this ambitious and necessary research program, we are laying a solid foundation for the future of digital investigations and evidence handling.”
About Harm van Beek
Prof. Dr. Ir. Harm van Beek (born 1975, Westerhoven) is a senior digital investigator at the NFI and, since 1 September 2024, Professor of Digital Forensics at the Faculty of Science of the Open University of the Netherlands. This special chair is a collaboration between the Open University’s Faculties of Science and Law and the NFI. Van Beek studied computer engineering at Eindhoven University of Technology, where he earned his PhD in 2005. During his studies, he co-founded the IT company ISAAC. In 2009, he joined the NFI, where he helped lay the foundation for the Hansken platform.