“Examining and interpreting the contents of a computer shares some of the attributes of an archeological exercise.
You start off with a series of rumours and expectations of what might be uncovered. But there are many layers representing different types of activity; some forms of activity have been completely lost, others can only be partially reconstructed. In some instances older building materials have been re-used to make later buildings. Sometimes quite extensive inferences have to be drawn from quite small fragments.
The interpreter of digital data, like the archaeologist, has to keep an open mind and be prepared to abandon a promising hypothesis once it becomes apparent that there is no longer much basis for it.
However, properly and carefully deployed, sometimes astonishing revelations can be stood up.”