Source camera identification (SCI) is a critical step for investigators in verifying the origin of evidential images or videos. Identifying the source of multimedia files has become a major challenge for forensic investigators due to the availability of editing software, recent developments in imaging technology, and the increase in the manufacture of smartphones. In this work, we focus on SCI from videos (SCIV), as many crimes today involve videos, and it is particularly challenging due to compression artifacts and misalignments caused by stabilization during video processing. Existing deep learning (DL)-based approaches exhibit comparatively better identification accuracy than conventional approaches, but lack a proper framework and fine-tuning of model parameters for increased performance. This paper explores an accurate and robust framework to extract and learn intrinsic camera features for SCIV. To arrive at the framework, different types of input, such as an original video I-frame, a noise residue, a denoised I-frame, PRNU of an original I-frame, and PRNU of a denoised I-frame, are investigated as possible inputs to a fine-tuned Convolutional Neural Network (CNN)-based DL classifier. This study also investigates the impact of additive noise on SCIV, based on which a hybrid approach is proposed that selectively applies denoising to an I-frame using a predefined noise threshold. MobileNetV3-Small is employed to learn camera intrinsic properties from the selected input, followed by a softmax-based classifier. Extensive experiments on two publicly available datasets demonstrate the effectiveness of our approach, with performance comparisons showing superior accuracy over most of the previous SCIV methods. We also present a threshold-based strategy to perform SCIV in an open-set scenario.
The rapid adoption of Internet of Medical Things (IoMT) devices in healthcare environments has increased exposure to network-based cyberattacks, highlighting the need for effective post-incident forensic analysis. While existing research largely focuses on real-time intrusion detection, comparatively little attention has been given to forensic approaches that support attack reconstruction and attribution in IoMT networks. This paper presents a forensic analysis framework for IoMT network traffic that emphasises interpretable flow-level artefacts, temporal behaviour, and protocol-level evidence. Using an IoMT network traffic dataset, the framework analyses statistical, temporal, volume-related, and protocol indicators derived from flow metadata, without relying on payload inspection or device-specific information. Statistical artefact profiling and inter-arrival time-based temporal reconstruction reveal distinct behavioural patterns across benign and attack traffic, enabling relative timeline reconstruction of attack activity. Protocol-level analysis further supports forensic attribution by linking observed anomalies to exploited network protocols. A lightweight Random Forest model is included solely as a supporting triage mechanism to prioritise suspicious traffic while preserving interpretability. The results demonstrate that meaningful forensic insight can be derived from flow-level artefacts alone, making the framework suitable for privacy-sensitive healthcare environments and complementary to detection-oriented IoMT security research.
Crime investigators rely on gathering and synthesizing information from various sources to reconstruct events and identify criminal activities. Internet of Things (IoT) devices can play a pivotal role in these efforts by capturing events that transpire before, during, and after a crime. However, extracting and analyzing data from IoT devices can be complex without prior technical knowledge and clear procedural guidance. In this case study paper, we outline the methodology for configuring Amazon IoT devices within a controlled laboratory environment to facilitate data collection. We demonstrate how forensic examiners and crime investigators can retrieve data and utilize it in investigations using Amazon IoT hardware and Visual Identification (Visual ID) technology. Specifically, data from Amazon IoT devices such as the Amazon Echo Show can autonomously log human presence without direct interaction, providing critical insights. This extracted information offers valuable evidence to more precisely reconstruct events for investigations.
The exponential growth of text-based digital evidence, particularly in mobile chat logs, challenges current forensic workflows. This is especially acute in investigations of coercive control, where evidence manifests not as a single ‘smoking gun’ but as a cumulative behavioural profiling of psychological abuse often missed by standard keyword searches. To address this data-to-insight gap, we present the Digital Conversation Analysis Pipeline (DCAP), a proof-of-concept Human-in-the-Loop (HITL) framework designed for investigative triage. The pipeline parses heterogeneous text-based evidence and analyses it using a novel hybrid classification architecture. The system detects individual linguistic markers and aggregates them into a cumulative behavioural profile, combining the precision of rule-based forensic search with the contextual recall of a BERT-based model. Acknowledging the strict ethical and privacy constraints that limit access to real-world forensic datasets, the model was initialised on a synthetic dataset and validated using a ‘Hybrid Injection’ stress-test, embedding 200 confirmed real-world toxic samples into the forensic timeline. In comparative experiments, the hybrid model achieved a 0.85 macro F1-score, significantly outperforming standard forensic keyword search baselines. We demonstrate the pipeline’s engineering utility on a simulated 8451-message case file. By isolating the Person Under Investigation (PUI), the system generated an auditable, quantitative triage report that reduced the target’s review volume by 92.8%. While further validation on diverse real-world data is required, this work proposes a foundational ‘warm-start’ framework for AI-assisted lead generation, prioritising explainability and investigator oversight over autonomous decision-making.
In zero_shot device source authentication, Social Network Service (SNS) processing induces severe feature homogenization, masking device-specific fingerprints and triggering a “false confidence” paradox. This is a difficult problem, and despite active studies in recent years, it remains a great challenge. We propose a device-aware forensics framework, which integrates multimodal feature fusion, dual-verification, and a three-component optimization suite: test-time style normalization, mild transfer learning, and advanced confidence calibration. Experiments show our method elevates the camera device detection rate from a baseline of 17% to 94.0% (mean, validated over 10 independent runs), with an average confidence of 0.825 and an Expected Calibration Error (ECE) of 0.197. We reveal a trade-off between detection rate and calibration reliability, validating a “performance first, then calibration repair” optimization path. This work offers insights for building test-time adaptive and high-reliability forensic systems.
The importance of digital evidence in traffic accident analysis is continuously increasing. Among them, Event Data Recorder (EDR) data is widely used as critical evidence in traffic accident investigations. However, in Korea, social questions about the reliability of the data itself continue to be raised due to the uncertainty of the recording time (Time Zero) of EDR data. In this study, we proposed a framework for the systematic validation of EDR data and developed a practical program. We cross-validated EDR data using various information from Dashboard Camera (DBC) installed in most vehicles in Korea. By applying the framework to traffic accidents that occurred in Korea, we compared the calculated Principal Direction of Force (PDOF) with actual vehicle damage patterns, verified engine status through audio signal analysis, and estimated Time Zero by extracting text from DBC and synchronizing temporal data. The proposed synchronization algorithm achieved average similarity scores of 0.978 for speed data and 0.83 for acceleration data across various collision scenarios. This framework objectively demonstrates the similarity between EDR and DBC data, improving the accuracy and reliability of traffic accident analysis. It is particularly valuable for controversial cases in Korea, such as suspected sudden unintended acceleration accidents.
To contribute to the understanding of the operationalisation of digital forensic science and the associated chal lenges, this study observes daily practices and interactions of a digital forensic unit. The observation was focused on four main questions: (1) What are the primary missions of a DFU? (2) What workflow procedures do DFUs use in performing their duties? (3) How useful are DFUs and digital traces at various stages of an investigation? (4) What obstacles do DFUs face in fulfilling their missions? This study draws on 160 hours of field observations conducted between January and March 2020 in a Swiss police force, the analysis of the unit internal casework database (2018-2019 past cases) and 6 semi-structured interviews with different stakeholders. The study is divided between an active participation in the digital forensic work (handling, analysing digital objects and reporting) and a passive participation in field work. Different uses and expectations of the digital forensic unit services depending on the investigation context were observed during the analysis of the field search notes, casework database and while conducting the interviews. The findings also allowed for the categorization and timelining of the types of activities conducted by a digital forensic unit.
Modern cloud-based services increasingly rely on RESTful APIs to manage user data. However, many of these APIs are undocumented and frequently change without notice, posing challenges to digital forensic investigations. First, undocumented APIs may expose forensic-relevant data while bypassing standard access logging. Second, frequent structural changes hinder reproducible and verifiable evidence acquisition. To address these challenges, we present FOREST, a framework for the automated discovery, analysis, and tracking of RESTful API behavior in real-world cloud environments. FOREST analyzes live API traffic generated through natural user interactions, identifies undocumented endpoints, extracts artifact-bearing responses, and generates OpenAPI Specifications. It also supports longitudinal schema comparison and parameter dependency analysis to ensure consistent data acquisition across service versions. We evaluate FOREST on Microsoft OneDrive, Microsoft Teams, and Mattermost. The results demonstrate its effectiveness in uncovering undocumented APIs, tracing structural API changes, and supporting reliable forensic analysis in dynamic cloud service environments.
Proprietary “black-box” forensic tools such as Bosch Crash Data Retrieval (CDR) and Berla iVe are widely deployed in vehicle event data recorder (EDR) and infotainment system investigations. While they offer rapid acquisition, broad hardware coverage, and outputs tailored for legal contexts, their internal decoding logic is opaque and complex to validate independently. This paper presents two controlled demonstrations simulating typical extraction scenarios: (1) EDR field completeness and temporal alignment testing, and (2) infotainment data completeness and parsing accuracy across simulated tool variants. In Demonstration 1, black-box output exhibited quantization, timestamp offsets, and missing fields that could materially alter accident reconstruction. In Demonstration 2, simulated GPS track extractions demonstrated spatial downsampling, coordinate rounding, and timezone misinterpretation, each of which could undermine cross-source correlation. Benefits, challenges, and limitations of commercial automotive forensic tools are discussed, alongside recommendations for independent validation, open-source crosschecks, and forensic quality assurance standards. The results underscore the importance of transparent methodologies and reproducible testing in the use of proprietary automotive forensic solutions.
File exfiltration conducted through bypass boot environments, such as the Windows Preinstallation Environment (Windows PE), poses a serious challenge to forensic investigations. Because endpoint security agents and logging mechanisms remain inactive, conventional artifacts of file access are absent. This study investigates the feasibility of using the NTFS $STANDARD_INFORMATION Accessed Time ($SI Atime) as a residual forensic indicator for detecting exfiltration events in Windows PE. Through controlled experiments, we analyze $SI Atime updates during file copy operations, examine their persistence under varying system conditions, and evaluate their evidentiary reliability over time. Our findings show that $SI Atime can reveal PE-based file access patterns in over two-thirds of cases, though reliability diminishes with prolonged use. To enhance robustness, we integrate Atime analysis with complementary artifacts, such as UEFI NVAR variables indicating abnormal boot order changes. This combined approach enables the reconstruction of exfiltration timelines even in the absence of logs or telemetry. The results highlight the potential of $SI Atime as a valuable residual artifact for detecting file exfiltration in bypass boot environments, offering investigators a methodological basis for addressing scenarios where traditional forensic sources are unavailable.
The automotive industry is undergoing a significant transformation driven by digitization. Modern cars are transitioning to digital and are now sophisticated computers on wheels. This digital revolution is driven by the integration of various computerized systems. One of the most noticeable systems, at least for drivers and occupants, is the In-Vehicle Infotainment (IVI) system. This system offers features such as radio, music playback and streaming, navigation, hands-free calling, and, in some cases, smartphone and internet connectivity. Data generated from user interactions with the vehicle information system can be valuable for digital forensics, providing artifacts such as call logs, contacts, GPS location history, and diagnostic data. However, acquiring and analyzing these data is challenging, as there are no universal standards for IVI systems. In this paper, we study the infotainment systems of four BMW vehicles from a digital forensic perspective. Specifically, we focus on two Computer-in-Car (CIC) BMW 3 Series systems, one from 2010 and another from 2012. We also analyze the Next Big Thing Evolution (NBT EVO) systems of two 2017’s BMWs, a 5 Series and a 7 Series. For this purpose, data from the infotainment hard disks were acquired and forensically analyzed. To overcome the lack of specific open-source tools to process these datasets, we developed two modules for the well-known Autopsy forensic software. The most relevant data recovered from the hard disks of the analyzed infotainment systems include phone call history, text messages, and linked smartphone IDs, such as Bluetooth addresses, International Mobile Equipment Identity (IMEI) and International Mobile Subscriber Identity (IMSI). The results indicate that the newer NBT EVO systems have more forensically meaningful data than the older CIC ones.
This paper outlines the essential needs for a forensic incident recorder (FIR) in autonomous vehicles, emphasizing its role in providing comprehensive data for post-incident analysis. The FIR must capture data from various vehicle systems, including onboard sensors, AI decision-making processes, internal diagnostics, V2X communications and cloud-based services, ensuring transparency and accountability. To ensure data integrity, the system must include encryption, tamper detection and redundancy. Furthermore, we introduce the concept of a forensic information system (FIS), an integrated solution for data storage, relevance determination and secure access, incorporating local and cloud-based storage. Triggers for permanent data storage and data upload to the cloud are suggested. Ultimately, the paper aims to highlight the need for comprehensive strategic and operational preparation for forensic investigations in the environment of autonomous, connected mobility.
The rapid advancement of large language models (LLMs) has simultaneously created opportunities and challenges for digital forensic science. This survey systematically examines the emerging intersection between generative artificial intelligence and digital forensics through our analysis of 33 peer-reviewed works. We map LLM capabilities across the established Digital Forensic Research Workshop (DFRWS) process model, identifying three strategic integration points where these technologies demonstrate measurable benefits - pattern recognition during the examination phase, evidence analysis during the analysis phase, and evidence presentation and reporting during the presentation phase. Our findings show that LLMs achieve substantial performance improvements across diverse forensic tasks, but critical challenges persist, including the fundamental tension between the probabilistic nature of LLM outputs and deterministic forensic requirements, alongside concerns regarding explainability, reproducibility, and legal admissibility. We identify significant research gaps in validation frameworks, forensic-ready architectures, and standardised evaluation protocols. The survey establishes a comprehensive research agenda spanning technical, methodological, and legal domains, emphasising the necessity for interdisciplinary collaboration and human-AI collaborative approaches to preserve forensic integrity when leveraging LLM capabilities.
The Tor darkmarket ecosystem, a hidden segment of the internet hosting a range of illicit activities, remains a critical challenge for cybersecurity and law enforcement. This study employs network analysis to explore the structure, connectivity, and vulnerabilities of Tor hidden services, focusing on the interplay of topics, communication channels, and languages. Using a bipartite network framework, we analyzed 82,285 onion services and 57,071 identification forms (IDs) collected over a 20-week period. Our findings reveal hacking as the dominant topic (57,233 services), followed by finance-crypto (17,900 services), with email (43,298 IDs) and Telegram (11,218 IDs) serving as primary communication channels. Linguistically, Russian prevails in hacking (50,852 services), while English dominates other topics (29,762 services), with Portuguese activity notable in Q&A forums (781 services). Network metrics and visualizations highlight structural contrasts: hacking's expansive, collaborative structure (high diameter, long average path length) contrasts with finance-crypto's compact, centralized network (high density, low path length), reliant on just four IDs to link its services. High-degree nodes underscore vulnerabilities to targeted disruptions. The overall network's fragmentation (1848 components) alongside a large dominant component (76.72 %) suggests both resilience and exploitable interconnectedness. These insights provide a comprehensive understanding of the Tor darkmarket's organization, identifying key leverage points for intervention. By bridging gaps in topical, linguistic, and structural analyses, this study offers actionable strategies for law enforcement to investigate and mitigate illicit activities on the Dark Web, demonstrating the power of network science in addressing cybercrime.
SQLite is a lightweight, file-based relational database that is widely deployed on mobile and IoT devices to store diverse data. Due to its widespread use, SQLite has become an important subject of interest in digital forensics. In particular, SQLite exhibits structural characteristics that allow deleted data to persist temporarily within database, specifically through internal components such as the freelist and Write-Ahead Log (WAL). As a result, deleted content often remains recoverable even after deletion requests, making SQLite a valuable source of forensic artifacts. These characteristics have motivated the development of various techniques and tools for recovering deleted records from SQLite. However, comparative evaluations of the strengths, limitations, and performance of each approach based on consistent criteria remain relatively scarce. To address this gap, this study systematically categorizes existing deleted record recovery techniques into three types, namely Metadata-based, Carving-based, and WAL-based, and compares their trade-offs. In addition, we select representative open-source SQLite recovery tools, such as Undark, SQLite Deleted Record Parser, Bring2Lite, and FQLite, and quantitatively measure their recovery performance, reliability, and throughput based on various deletion scenarios. We also present a detailed analysis of incorrect recoveries (false positives) caused by structural changes in the database. These findings can provide practical guidelines for selecting the most suitable SQLite recovery method depending on the context, and can contribute to the development of more effective recovery techniques and tools in the future.
Digital forensic scientists primarily rely on individual internal reasoning and categorical conclusions when evaluating evidence in casework. This can make it difficult to maintain structured reasoning that is logically sound, balanced, robust, and transparent. Trojan horse defense cases exemplify these challenges in evaluating digital forensic findings. The key challenge in such cases is combining multiple observations into a logically sound probabilistic evaluation while maintaining an understandable forensic report for court and other recipients. To address these challenges, we propose using the likelihood ratio framework to evaluate digital findings in Trojan horse defense cases, with Bayesian networks serving to visualize the evaluation and derive a likelihood ratio. We will illustrate this approach by demonstrating the construction of a Bayesian network through a case example. We show that these networks are very suitable to model the evaluation of digital evidence in Trojan horse defense cases and that they can be easily adapted for various case circumstances. Based on our findings, we strongly recommend broader exploration of Bayesian networks in digital forensic casework.
As an application focusing on generative artificial intelligence, open-source LLM DeepSeek has been widely adopted by many research institutions and international companies around the world. More than 60 million active daily users have been reported on DeepSeek by QuestMobile. Given the rapid growth in the population of DeepSeek users and the fact that mobile devices gradually function as centers for users to interact with AI chatbots, it is essential to conduct thorough mobile forensics along with network forensics on the DeepSeek mobile app to discover potential evidence stored in both Android and iOS devices and provide valuable insight into its potential vulnerabilities. However, given the app’s recent introduction, there is currently a lack of systematic forensic research that investigates its potentially valuable artifacts, data persistence mechanisms, and network communication patterns across platforms. This research focused on user data and application usage, such as log files, metadata, and other critical traces, which revealed insights into its operational behavior in different versions of DeepSeek and the data sent over the network. Our analysis can help forensic researchers and investigators fully utilize the forensic value of DeepSeek on mobile devices to have a clear view of what can be recovered and obtained.
Google provides a diverse suite of applications (e.g., Gmail, Google Drive, Google Maps, and Google Docs Editor), which are interconnected to enhance user convenience. This study comparatively analyzes the artifacts generated by 25 Google applications on Android and iOS platforms. We start by describing an artifact acquisition method and the utility of artifacts in digital forensic investigations. Based on these investigations, we identify the differences between the two platforms in terms of their data storage patterns and demonstrate that the integrated analysis of both platforms provides a more comprehensive set of artifacts than single-platform analysis. Subsequently, we analyze the synchronization among Google applications. We demonstrate how various applications share and synchronize data, and present methods for utilizing the interactions among the corresponding artifacts. The results of this analysis, we develop a tool for effectively tracing and analyzing the collected artifacts. By comparing the artifact acquisition rates of Android and iOS, we highlight the distinct data provided by each platform. Compared with existing methods, our integrated approach is expected to provide richer and more accurate digital evidence.
The impact of AI has not bypassed the field of digital forensics. However, despite the emergence of AI-based digital forensic methods and tools, their widespread adoption remains limited due to ethical, legal, and practical concerns. While existing research has proposed various solutions to support AI integration in digital forensics, many reiterate challenges already present in traditional digital forensics, focusing heavily on explainable AI, and often overlooking real-world feasibility. Thus, this study investigates the practical challenges affecting the adoption of AI in digital forensics by directly engaging with practitioners.To this end, we conducted a survey and interview study involving 28 digital forensic experts to explore their experiences with AI-based tools, their perceptions of AI in digital forensics, and the practical challenges they encounter. Our findings highlight key concerns related to validation, transparency, and the explanation and presentation of AI-generated evidence in court. We also find that practical challenges are often broader than those discussed in theory, warranting deeper, practice-oriented analysis and perspectives.Based on these findings, we propose a practitioner-focused framework to support stakeholders, including forensic professionals, developers, law enforcement, regulators, and researchers, in fostering standardized, responsible, and effective adoption of AI-based digital forensics. Rather than replacing existing procedures, our framework builds on traditional digital forensic processes, extending them to address AI-specific requirements. Finally, as part of this proposed framework, we provide practical recommendations for the development and deployment of AI-based digital forensic tools that are better aligned with real-world investigative needs.
Detection methodologies for steganography are a topic of study both within academia and in law enforcement. For the development of detection methods and the validation of their use for law enforcement, a large-scale representative dataset is essential. Current datasets are lacking in terms of representing real-life steganography, as they only include low resolution images, are taken with only a few different cameras, and are validated with only a minimal number of steganography methods. A new large-scale comprehensive image steganography dataset is needed with many typical examples of steganography one could encounter in casework. To that end, we present the REVEAL dataset containing 100.006 images taken with more than 50 different cameras. The set contains a rich variety of images, the attributes of which have a wide distribution. There are for example over 200 different sizes, ranging from 256x256 to 7680x4320. All 100.006 images have then been subjected to many different chains of image preprocessing steps. After the preprocessing, a total of more than 50 different image steganography algorithms were used to hide information in the images. This results in three image sets namely: original, preprocessed, and stego, in total more than 300.000 images. This properly annotated dataset can help to achieve accurate detection using supervised machine-learning based methods. At the same time, this dataset can be used for both forensic evaluation and validation, thus improving the applicability of detection methods. The dataset with full annotations, algorithms, and results is made publicly available.
