INVESTIGATION CATALYST
INCIDENT INVESTIGATION SUPPORT

� 2004 by Starline Software Ltd.
FILLING GAPS
Defining gaps

The need for more data during an incident investigation is identified by "gaps" or missing EBs on a Matrix in the Matrix View. The gaps can define what data are needed for the investigator, and point to the next data acquisition task during an investigation as the Matrix grows. Additional gaps or data needs can be identified using the Overlap View, by determining if the interactions among parallel or overlapping EBs are fully understood and accurately described.

Investigation Catalyst supports the discovery and definition of gaps in the Investigator's understanding of the incident in three ways. A gap exists when missing frames in the mental movie of the incident are observed.

The EBs on a Matrix also expose gaps in the Investigators' understanding of the incident at a glance: a gap exists where there is a visible break in the flow of the linked EBs, or where logical reasoning tells the investigator that something must have happened between one EB and another EB that followed it.

Investigation Catalyst provides another unique way to identify missing EBs. When EB sets are subjected to the Necessary and Sufficient logic tests, investigators often find that one or more EBs are required to complete the set needed to produce the next EB reliably. (N&S inputs should define replicable interactions.)

Hypothesizing fillers

"Filler" EBs to bridge gaps can be developed by just going back to the site and making more observations to acquire more data. A more efficient way is to hypothesize the possible scenario(s) of EBs between the two bounding EBs on each side of the gap, which starts with the earlier EB and ends with the later EB. Investigation Catalyst provides a way to develop such scenarios.

One way to do this is for Investigators to create a new Matrix, and add the beginning EB and ending EB to the new Matrix. Then, starting with the beginning EB, create one or more hypothetical sequences of input/output EBs that would produce the ending EB after the beginning EB occurs, and enter them on the Matrix, color coded as temporary EBs. This can be done much like one builds logic tress, substituting the ending EB for the top event on the tree, and working "down the tree" to the beginning EB at the bottom of the tree, or alternatively work "up the tree" to the top EB.

On the Matrix, this is done horizontally, rather than vertically, and the top and bottom of the tree bound the effort, but the reasoning process is similar to logic tree development.
Matrixes can be concatenated at any time with Investigation Catalyst to show the current status of the investigation.

The smaller the gap, the easier it is for Investigators to bridge the gap with filler EBs.

Getting confirming data

The temporary filler EBs on the Matrix tell the Investigator what data should be sought to confirm each EB. This focuses the investigator's attention on data that will expedite completion of the investigation, improving the efficiency of the investigation process.

As needed data is acquired it can be used to complete the EBs supported best by the new data.

Completing EBs

When the scenario of EBs best supported by existing or additional data is determined, Investigators can use the Inspector Panel to update each EB source, color label and, if necessary , the wording of the EB. These changes are displayed on the revised EBs on the Matrix when they are made. Surplus EBs, or EBs unsupported or contradicted by acquired data, can be deleted, leaving only relevant EBs on the Matrix.

Updates

With the gap filled, the Matrix provides a convenient reference document against which to compare any additional data that may be unearthed before the end of the investigation. New data may require updating of the Matrix if any of the logic tests result in anomalies.


Previous | Next Page | Tutorials Menu