AI-Enabled Digital Forensic Evidence Examination

Abstract

Digital forensics is crucial for the prosecution of offenders in cyberspace, including nation-state actors and non-nation-state actors. The evidence discovered, verified, and associated during the evidence examination phase serves as the basis for digital forensic analysis and eventually the basis for the verdict of a judge and a jury. However, the current digital forensic evidence examination procedure usually takes a relatively long time, demands a great amount of resources, and requires great efforts from human experts. The biggest challenges in this procedure are accuracy and speed. Nevertheless, in some cases, delay is not allowed, as it may have significant impact upon a critical mission, especially a time-sensitive one. To address this challenge, this paper recommends an AI-based digital forensic evidence examination architecture that is empowered by contextual binding, machine learning, and human-machine teaming. In this approach, human experts are teamed up with artificial intelligence (AI) systems in conducting evidence examination. This approach certainly improves the efficiency and effectiveness of an investigation, thus successfully supporting missions.