Evaluating the Reliability of Digital Forensic Evidence Discovered by Large Language Model: A Case Study
Organizations: School of Criminal Justice, College of Public Affairs, University of Baltimore, Maryland, USA
Abstract
The growing reliance on AI-identified digital evidence raises significant concerns about its reliability, particularly as large language models (LLMs) are increasingly integrated into forensic investigations. This paper proposes a structured framework that automates forensic artifact extraction, refines data through LLM-driven analysis, and validates results using a Digital Forensic Knowledge Graph (DFKG). Evaluated on a 13 GB forensic image dataset containing 61 applications, 2,864 databases, and 5,870 tables, the framework ensures artifact traceability and evidentiary consistency through deterministic Unique Identifiers (UIDs) and forensic cross-referencing. We propose this methodology to address challenges in ensuring the credibility and forensic integrity of AI-identified evidence, reducing classification errors, and advancing scalable, auditable methodologies. A comprehensive case study on this dataset demonstrates the framework's effectiveness, achieving over 95 percent accuracy in artifact extraction, strong support of chain-of-custody adherence, and robust contextual consistency in forensic relationships. Key results validate the framework's ability to enhance reliability, reduce errors, and establish a legally sound paradigm for AI-assisted digital forensics.
Figures & tables
| Artifact Type | Database Source (Column, Row Data) | Extracted Artifacts | Destination CSV file |
|---|---|---|---|
| (realVal,…a\[email protected]\x0…) | [email protected] | Email.csv | |
| Timestamp | (proto,…x03\x0f“1617477858090”\xe2\x03\x…) | 03 April 2021 15:24:18 | Timestamp.csv |
| Phone Number | (blobVal,…n\x0c+16506808040\x12\t\n\x01…) | +16506808040 | Phone_number.csv |
| Name | (Data,… " ull_name " : " Marsha Mellos " , " pro…) | Marsha Mellos | Name.csv |
| Google Search Query | (title, hidden photos apps - Google Search) | hidden photos apps | Google_Search.csv |
| MAC Address | (address, 34:C7:31:F8:61:3B) | 34:C7:31:F8:61:3B | Mac_addr.csv |
| Edge Type | Example of Hypothesis | Total | Valid | Invalid |
|---|---|---|---|---|
| Timestamps and Application Name | User logged into Google Drive on 2021-04-03 at 15:24:18 EDT. | 24 | 22 | 2 |
| User searched for “interesting car apps” in Chrome on 2021-07-08 00:02:39 EDT. | ||||
| User initiated a Bluetooth connection on 2021-05-20 at 21:18:53 EDT. | ||||
| Email and Application Name | User accessed Google Drive associated with the email [email protected]. | 5 | 3 | 2 |
| User account associated with the email [email protected] was linked to Snapchat. | ||||
| The Twitter account associated with the email [email protected] is linked to Heisenberg’s Twitter interactions. |
Digital Forensics
Digital forensics develops methods to recover, authenticate, and interpret digital evidence while preserving its integrity for investigations.
See all 71 papers