# The role of the user interface in digital investigations: how UI convenience and intuitiveness speed up data analysis and search Nikita Pavlov · Zero eDiscovery MOSCOW FORENSICS DAY ’25 · Day 2 — Friday, 12 September 2025: information security day · Scheduled 15:35–16:05 · In the recording 07:28:23–07:51:30 Talk summary · https://2025.moscow-forensics-day.workers.dev/en/summary/17-pavlov Transcript: https://2025.moscow-forensics-day.workers.dev/en/transcript/17-pavlov · Slides: https://2025.moscow-forensics-day.workers.dev/en/slides/16-pavlov-interfeis-rassledovaniya · Watch from 07:28:23: https://youtu.be/4V7Wez3L_58?t=26903 --- ## In brief The talk is not about artifacts but about designing the interfaces of investigation tools: "design" means engineering, not decoration. Theory — Hick's law, 7±2, Gestalt; practice — incident logs and a checklist for the vendor. Not a sales pitch: Zero eDiscovery is named but not shown. Little tie to investigation: there are two on-topic examples, the rest is a UX primer. ## Key points - The speaker is a co-founder of Zero eDiscovery and the designer of its interface; UI was chosen because it is the topic "covered the least" in forensics. - Interfaces are developed by "people who aren't specialists" with no school of design behind them — "everything is piled into one heap"; Hick's law: "the more choices, the longer the decision", and in Word and Excel people use "at most 6 or 7 functions". - UX is utility (the ergonomics of physical objects), UI is what is "written in code"; the 7±2 load: Google, "which has no functions whatsoever", versus the Mail.ru search engine, "…never changed at all since 2005 or so". - Gestalt: proximity, similarity, common fate — "this button was here the last time I was here"; the counterexample is the 2018 redesign of Google Workspace and the update "around 2020": "everyone… was lost". - Closure was skipped as "a bit convoluted", he promised to come back to it and did not; figure-ground is "much the same as similarity and proximity". - Incident logs: "a wall of white lines on black", 10,000 lines, and "by the hundredth line" the brain is overloaded; indexing and "concrete points" to search for — faster "by tens, if not hundreds of times"; color: red means alerts, orange needs attention, green is good. - The checklist for the vendor: unified search, templates and dashboards, visualization of relationships (affiliated persons, a "corruption scheme"), hotkeys (Alt in Excel), unambiguous button colors, feedback — "it at least showed a spinner". - The bottom line: an interface frees up time for the key tasks (the evolution of technical tools, the 2000s–2015s, with customs "the closest example"); demand, and "try not to put up with" it. ## Tools, artifacts, technologies - **Zero eDiscovery** — the speaker's platform for investigations and audits; not demonstrated, no figures. - **Word, Excel** — overloaded (6-7 functions), Excel is praised for its Alt shortcuts; **Yandex and VK products** are mentioned; **Google**, **Yandex** (search) — the models; **Mail.ru search**, **Google Workspace** — the counterexamples. - **Logs, tables** — indexing, search, highlighting; **dashboards, relationship graphs, hotkeys, unified search** — to be demanded from the vendor. **"STS"** — technical means (customs ones by context), 2000–2015, the phrase is garbled in the Russian original. ## Legal and organizational context Nothing was said: no laws, no articles, no agencies, no methodologies. The speaker says: investigation, audit, incident, forensics, working in agencies. There is a single frame — the user and the vendor: it is the user who formulates the requirements; an objection from the audience — the developer will adapt only to a client "with tens of millions a year in support fees". Collaborativeness: different settings among colleagues break communication. ## Questions from the audience - **Alexey** (probably Alexey Drozd, SearchInform), himself the vendor of an "overloaded" interface: the checklist has no customization — what matters is your own order of filters and columns, "in 99% of cases… some four main columns are enough for me". - **The answer**: that is exactly the "templates and dashboards" point, which he "didn't elaborate enough" on; but he does not champion customization — UX "should be close to uniform". - **From the audience**: the problem is removed by an end-to-end identifier of "a piece of intercepted data", and over a single email "there aren't 10 people poring… at once". There were no other questions. ## The speaker's position Design is engineering, aesthetics are secondary; overload is the disease of products built with no school of design, and the one who has to cure it is the user-customer: know the principles, demand, do not put up with it. He argues with Drozd gently: he grants that the remark is right, but insists on uniformity of UX. The tone is a lecture, with no selling. ## Quotes - "…to mean engineering rather than decoration…" - "…we would basically cut the work down by tens, if not hundreds of times." - "…when I click this button, it at least showed a spinner." - "…try not to put up with people building bad, inconvenient interfaces."