Anti-ForensicsRendering Digital Investigations Irrelevant
Reference Library · Investigation notes

Read sampling and error rates without losing the denominator

Distinguish false-positive rate, precision, repeated trials, and operational prevalence.

Materially reviewed · Original editorial guide

2 minute read · Source-based editorial synthesis
On this page
  1. Name the unit being counted
  2. Build the classification table first
  3. Use an explicitly hypothetical example
  4. Inspect how cases entered the study
  5. Keep development and evaluation distinct
  6. Describe uncertainty honestly

A performance percentage has little meaning without its unit, reference labels, selection process, and denominator. A detector can appear successful on a convenient demonstration while remaining untested on the inputs that matter in an investigation. Read the study design before comparing the headline values.

Name the unit being counted

Decide whether a unit is a file, record, person, session, device, or test run. Count related items carefully. Many frames from one video share a source; repeated executions of one input describe repeatability for that input. They do not automatically provide the same coverage as independently selected videos. State the dependence instead of enlarging the apparent sample by relabeling derivatives as unrelated cases.

Build the classification table first

For a binary task with independently established reference labels, retain counts of true positives, false positives, true negatives, and false negatives. False-positive rate divides false positives by all reference-negative units. Precision divides true positives by all positive outputs. Recall divides true positives by all reference-positive units. These ratios answer different questions. Always publish their counts and any excluded or inconclusive units.

Use an explicitly hypothetical example

Suppose a teaching dataset contains 100 reference-positive files and 900 reference-negative files. A fictional tool flags 80 of the positives and 90 of the negatives. Its recall is 80/100, its false-positive rate is 90/900, and its precision is 80/170. These are arithmetic examples, not measurements of a real product. The different denominators explain why “80 percent detection” cannot establish that a flagged file has an 80 percent chance of belonging to the positive class.

Inspect how cases entered the study

Record the target population, selection frame, inclusion criteria, missing inputs, and exclusions. A balanced constructed dataset can expose particular failures. Its class proportions need not match the material encountered in practice. Do not import its precision directly into a different population. If operational prevalence is unknown, say so and keep the observation at the level the study actually supports.

Keep development and evaluation distinct

Identify whether examples influenced threshold selection, parser changes, or examiner training before the final evaluation. Reusing a failure to improve a method is productive development, but reporting the same example as fresh independent evidence can overstate performance. Freeze a final protocol and preserve an evaluation set that was not used to make those choices, where the study question permits.

Describe uncertainty honestly

A small sample with no observed errors establishes only that no errors were observed in those trials. It does not establish a zero operational error rate. If an interval or statistical model is used, state the model, assumptions, sample dependence, and calculation method. Do not manufacture numerical precision when the source selection is not representative enough to justify the intended inference.