SoK: Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency

2024-02-29

arXiv.org

AI Summary

Large language models (LLMs) in digital forensics face critical challenges—including bias, poor interpretability, weak admissibility in court, high hardware overhead, and ethical–legal risks. Method: This work systematically defines, for the first time, the applicability boundaries and core risks of LLMs across forensic stages (evidence identification, log parsing, report generation) and proposes a judicially grounded evaluation framework and trust-enhancement principles. It integrates prompt engineering, retrieval-augmented generation (RAG), domain-specific knowledge injection, and explainability analysis to ensure chain-of-custody integrity and evidentiary admissibility. Contribution/Results: Experiments demonstrate a 40% reduction in preliminary analysis time and >92% recall of critical forensic leads. The approach provides both theoretical foundations and a deployable technical paradigm for designing automated, court-compliant forensic tools.

Technology Category

Machine Learning: Large Multimodal Models (LMMs)Natural Language Processing: (Large) Language ModelsData Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendationSearch and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved informationSemantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Problem

• Digital Forensics
• Large Language Models
• Ethical and Legal Issues

Innovation

• Large Language Models
• Digital Forensics
• Law Enforcement Efficiency