English

Evaluating the Reliability of Digital Forensic Evidence Discovered by Large Language Model: A Case Study

Cryptography and Security 2026-02-25 v1 Artificial Intelligence

Abstract

The growing reliance on AI-identified digital evidence raises significant concerns about its reliability, particularly as large language models (LLMs) are increasingly integrated into forensic investigations. This paper proposes a structured framework that automates forensic artifact extraction, refines data through LLM-driven analysis, and validates results using a Digital Forensic Knowledge Graph (DFKG). Evaluated on a 13 GB forensic image dataset containing 61 applications, 2,864 databases, and 5,870 tables, the framework ensures artifact traceability and evidentiary consistency through deterministic Unique Identifiers (UIDs) and forensic cross-referencing. We propose this methodology to address challenges in ensuring the credibility and forensic integrity of AI-identified evidence, reducing classification errors, and advancing scalable, auditable methodologies. A comprehensive case study on this dataset demonstrates the framework's effectiveness, achieving over 95 percent accuracy in artifact extraction, strong support of chain-of-custody adherence, and robust contextual consistency in forensic relationships. Key results validate the framework's ability to enhance reliability, reduce errors, and establish a legally sound paradigm for AI-assisted digital forensics.

Keywords

Cite

@article{arxiv.2602.20202,
  title  = {Evaluating the Reliability of Digital Forensic Evidence Discovered by Large Language Model: A Case Study},
  author = {Jeel Piyushkumar Khatiwala and Daniel Kwaku Ntiamoah Addai and Weifeng Xu},
  journal= {arXiv preprint arXiv:2602.20202},
  year   = {2026}
}

Comments

10 pages, 5 figures. Published in the Proceedings of the 2025 IEEE 49th Annual Computers, Software, and Applications Conference (COMPSAC), Toronto, ON, Canada, 8-11 July 2025

R2 v1 2026-07-01T10:48:31.246Z