Read and respond to the text below, provide a feedback and ask question to begin a discussion: A class characteristic is a characteristic or trait that helps to identify the class or group a piece of evidence originated from.

An individual characteristic is a subcategory of the class characteristic that contains a single identifier or trait. While there may be many items in the same class, an individual characteristic would point to only one item within the group/class.

When working with digital evidence it is important to be able to find an individual characteristic because the single identifier often led to the suspect you are attempting to identify and locate. However, in order to locate the individual characteristic, you must have a class characteristic in order to narrow the scope enough to locate the individual characteristic. An example would be an iPhone extraction on a Cellebrite UFDR file. I am able to identify both the make and model of the mobile device, these would be class characteristics. There are also individual characteristics identified in the device which help to attribute the device to the single owner. The individual identifiers found on the UFDR file would be the IMEI,International Mobile Equipment Identity,there is only one IMEI for this device and no other device can have the same IMEI. Some devices now have two due to the E-SIM and you would need to identify the class characteristic, make-model, to account for this; however, they are both still single identifiers. There are also user individual characteristics such as the IMSI,International Mobile Subscriber Identity, and MSISDN,Mobile Station Integrated Services Digital Network, also known as a phone number. These individual characteristics would lead to additional search warrants to cellular carriers for subscriber records, call detail records and SHIELD,historical location data stored by a cell phone provider,if still available. The subscriber records would lead, to the account holder, who the device has been communicating with and where it was located while on the cellular network. Another example would be a laptop. There are class identifiers similar to mobile devices, however you would also be able to identify the class characteristic, ISP, the network the computer utilized. This would then lead you to obtaining a search warrant for account records from the ISP for the individual characteristic, MAC address, IP address and account holder. I like the think of the class characteristic as a hint that points me in the right direction and an individual characteristic as the end goal.