Investigation Methodology

Investigation Methodology

A structured approach to conducting investigations that produces defensible, evidence-based conclusions.

When to Use

Use this methodology when you need to:

• Investigate why something happened (incidents, bugs, failures)
• Understand how a system works (codebase archaeology, architecture analysis)
• Research a topic thoroughly (technology evaluation, security analysis)
• Trace root causes beyond surface symptoms
• Build a defensible understanding from scattered evidence

Key indicator: The answer isn't immediately obvious and requires gathering evidence from multiple sources.

Investigation Framework

Phase 1: Scoping and Hypothesis Formation

Define boundaries before diving in:

• Clarify objectives: What questions must be answered?
• Define success: What does a complete answer look like?
• Form hypotheses: Based on available information, what are the likely explanations?
• Identify evidence needs: What would confirm or refute each hypothesis?
• Map information sources: Where might evidence exist? (logs, code, documentation, configs, git history)

Stopping point: You have 2-3 testable hypotheses and know where to look for evidence.

Phase 2: Evidence Gathering

Cast a wide net, then focus:

• Gather broadly: Collect more evidence than you think you need initially
• Document everything: Source, timestamp, context for each piece of evidence
• Look for patterns: What appears repeatedly? What's anomalous?
• Cross-reference: Validate findings across multiple sources
• Note gaps: What evidence is missing? What might that indicate?
• Preserve originals: Work with copies when analyzing, keep originals intact

Stopping point: You have enough evidence to evaluate all hypotheses, or you've exhausted available sources.

Phase 3: Analysis and Synthesis

Evaluate evidence against hypotheses:

• Test each hypothesis: Does the evidence support or contradict it?
• Apply Occam's Razor: Prefer the simplest explanation that fits all facts
• Actively disprove: Try to break your own theories before accepting them
• Separate correlation from causation: Just because A precedes B doesn't mean A caused B
• Rate confidence: How certain are you? What would change your mind?
• Acknowledge uncertainty: What remains unknown or ambiguous?

Stopping point: You have a conclusion that explains all evidence, or you know why a conclusion isn't possible.

Phase 4: Documentation and Recommendations

Structure findings for action:

• Narrative structure: Tell the story in logical order
• Separate facts from interpretation: Make clear which is which
• Actionable recommendations: What should be done based on findings?
• Preventive measures: How can similar issues be avoided?
• Further investigation: What questions remain unanswered?

Stopping point: Someone unfamiliar with the context could follow your reasoning.

Methodological Principles

Evidence Hierarchy: Prioritize by reliability:

1. Primary sources (logs, code, data) over secondary (documentation, memories)
2. Timestamped evidence over estimates
3. Multiple corroborating sources over single sources

Adversarial Thinking: Actively consider:

• What could go wrong?
• What assumptions might be false?
• What are we not seeing?

Timeline Reconstruction: Build chronological event sequences—time-based analysis often reveals causation that static analysis misses.

Follow the Data: Let evidence guide conclusions. When evidence contradicts hypotheses, abandon the hypothesis—not the evidence.

Document the Journey: Record not just what you found, but how you found it. Your investigation path may be valuable for future researchers.

Output Format

Structure investigation outputs using the templates in docs/​investigations/​README.md. Key sections:

# Investigation: [Topic]

## Summary

[2-3 sentence overview of findings]

## Background

[Context and why this investigation was needed]

## Methodology

[How you investigated - sources, approach]

## Findings

[Organized by theme or chronology]

### Finding 1: [Title]

**Evidence**: [What you found] **Source**: [Where you found it]
**Significance**: [What it means]

## Conclusions

[Your interpretation of the findings]

- Confidence level: [High/​Medium/​Low]
- Key uncertainties: [What you don't know]

## Recommendations

[What should be done based on findings]

## Appendix

[Supporting evidence, raw data, timelines]

Quality Checklist

Before concluding any investigation:

• All initial questions have been addressed (or documented why they couldn't be)
• Evidence supports stated conclusions
• No logical gaps or unsupported leaps
• Confidence levels are stated for uncertain conclusions
• Recommendations are actionable and specific
• Someone unfamiliar with context could follow the reasoning
• Dead ends are documented with explanation

Scaling to Complexity

Simple investigation (clear problem, limited scope):

• 2-3 sources
• Single hypothesis track
• Stop when evidence converges

Moderate investigation (unclear cause, multiple systems):

• 5-10 sources
• 2-3 hypothesis tracks
• Stop when you can explain all evidence

Complex investigation (systemic issue, many unknowns):

• 10+ sources, multiple types
• Multiple hypothesis tracks with branches
• Stop when you have high confidence or documented why certainty isn't possible

Too complex? Consider breaking into multiple focused investigations.