The Dog That Didn’t Bark: Incident Forensics the Sherlock Holmes Way
‘It is a capital mistake to theorise before one has data,’ Holmes warned. Incident investigations fail exactly there — and the most important clue is often the log line that isn’t there.