A well-done visual does not have to be a stunningly beautiful one. Excellent visuals aren’t about the visuals themselves, but about how the visual helps the audience to better understand a particular subject. Luckily for us, a simple and well-planned visual can communicate information as good as a gorgeous one. In fact, sometimes simple is better. Just as someone can get lost in the transcendent prose of a wordsmith, so they can also miss the forest for the trees if the visual is more about conveying its own beauty than actually explaining a subject.

The whole purpose of visuals within the context of this book is to take complicated technical concepts and explain them in an easily understandable way. With this as our goal, we will examine in this chapter what our mind-set and priorities should be as a digital forensics examiner playing the part of a graphic artist, and not the other way around.

Sometimes when you speak with someone who is an expert in their field it can be quite daunting, and this is particularly true if this is an area where you have little to no knowledge. In all likelihood, the expert is not trying to confuse you or to obfuscate the information, but instead the body of water between the shore of his/her knowledge and yours is simply too far to cross. Many of us have had this experience with a professor in college, where subjects were taught as if they are as simple as day, but to the students it is like learning alien hieroglyphics.

It is important to remember that as an expert, you take much of your knowledge for granted. When explaining anything, whether it is through language, an illustration, or both, try to remember back when you were a novice at your discipline. If you could go back in time and explain to yourself a difficult technical concept you struggled with then, how would you do it? I bet that explanation wouldn’t be laden with acronyms, jargon, or geek speak. You would probably try to find something every person can relate to and use that to explain the concept, to find common ground with the younger you, and use that as a launching pad to explain the concept.

Even seemingly simple questions can sometimes become quite daunting when you think about trying to translate it to a layperson. For example, even if we take a simple question such as “how does a computer organize data?” it takes serious thought to decide where to start.

With a layperson, starting with operating systems, file systems, or the difference between a hard drive and a solid state drive is almost assuredly not the right place. Remember, you have to assume that your audience has only the most basic knowledge of the technology you are explaining.

Maybe a better place to start is with something everyone has experience with; like a filing cabinet. Take a look at Fig. 2.1. You can explain how a computer stores data on a hard drive as a filing cabinet, with drawers, folders, and files. The cabinet itself would be the hard drive; each of the drawers in the cabinet would be a partition or volume, with each partition containing folders and the folders containing files.

So if you explained this in the courtroom, using the illustration as your guide, you could explain it like this:

An illustration needs to serve a particular purpose. One illustration is not going to be sufficient for you to explain to an audience both the general and specific ways computers organize data. The filing cabinet is great for general understanding, but if forensic artifacts in your case are related to a particular type of very specific data, then you need a custom illustration that can properly explain that data.

While the illustrations in this book and others will be provided to you, and will be useful for many scenarios, there will be times when you will need to make very specific illustrations.