SoK: Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency

2024-02-29

arXiv.org

AI Summary

Large language models (LLMs) in digital forensics face critical challenges—including bias, poor interpretability, weak admissibility in court, high hardware overhead, and ethical–legal risks. Method: This work systematically defines, for the first time, the applicability boundaries and core risks of LLMs across forensic stages (evidence identification, log parsing, report generation) and proposes a judicially grounded evaluation framework and trust-enhancement principles. It integrates prompt engineering, retrieval-augmented generation (RAG), domain-specific knowledge injection, and explainability analysis to ensure chain-of-custody integrity and evidentiary admissibility. Contribution/Results: Experiments demonstrate a 40% reduction in preliminary analysis time and >92% recall of critical forensic leads. The approach provides both theoretical foundations and a deployable technical paradigm for designing automated, court-compliant forensic tools.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: (Large) Language Models
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust

Application Category

• User Modeling, Personalization and Recommendation: Large Language Models (LLM) for user modeling and recommendation
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions

Problem

• Digital Forensics
• Large Language Models
• Ethical and Legal Issues

Innovation

• Large Language Models
• Digital Forensics
• Law Enforcement Efficiency