Every develoment and maintenance project collects and stores information,
although some collect more than others. As investigators, we prefer to
get involved with projects before they start, so that we can recommend
what should be collected and how. But often we have no input until the
project is well under way, or even after it is completed. Software forensics
seeks to understand what we can learn from digging through the collected
data after the fact. For instance, sometimes having some (rather than all)
information is enough to make determinations about crucial relationships.
And the incomplete information can lead us to new analysis techniques,
such as Kitchenam's suggestions for handling unbalanced data sets.
Analyzing the colelcted data helps us to make recommendations about what
should be collected on the next project, as well as assisting us in setting
hypotheses for future studies.