Forensic Science International-Digital Investigation最新文献_第10页

Practitioner-driven framework for AI adoption in digital forensics 在数字取证中采用人工智能的从业者驱动框架

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-11-12 DOI: 10.1016/j.fsidi.2025.302030

Maryna Veksler , Kemal Akkaya , Selcuk Uluagac

{"title":"Practitioner-driven framework for AI adoption in digital forensics","authors":"Maryna Veksler , Kemal Akkaya , Selcuk Uluagac","doi":"10.1016/j.fsidi.2025.302030","DOIUrl":"10.1016/j.fsidi.2025.302030","url":null,"abstract":"<div><div>The impact of AI has not bypassed the field of digital forensics. However, despite the emergence of AI-based digital forensic methods and tools, their widespread adoption remains limited due to ethical, legal, and practical concerns. While existing research has proposed various solutions to support AI integration in digital forensics, many reiterate challenges already present in traditional digital forensics, focusing heavily on explainable AI, and often overlooking real-world feasibility. Thus, this study investigates the practical challenges affecting the adoption of AI in digital forensics by directly engaging with practitioners.</div><div>To this end, we conducted a survey and interview study involving 28 digital forensic experts to explore their experiences with AI-based tools, their perceptions of AI in digital forensics, and the practical challenges they encounter. Our findings highlight key concerns related to validation, transparency, and the explanation and presentation of AI-generated evidence in court. We also find that practical challenges are often broader than those discussed in theory, warranting deeper, practice-oriented analysis and perspectives.</div><div>Based on these findings, we propose a practitioner-focused framework to support stakeholders, including forensic professionals, developers, law enforcement, regulators, and researchers, in fostering standardized, responsible, and effective adoption of AI-based digital forensics. Rather than replacing existing procedures, our framework builds on traditional digital forensic processes, extending them to address AI-specific requirements. Finally, as part of this proposed framework, we provide practical recommendations for the development and deployment of AI-based digital forensic tools that are better aligned with real-world investigative needs.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302030"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145527964","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Dial M for Mixer: A methodological approach to forensic analysis of unknown devices using the thermomix TM6 Dial M for Mixer：使用thermomix TM6对未知设备进行法医分析的方法学方法

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301983

Maximilian Eichhorn, Felix Freiling

引用次数: 0

Welcome to the Proceedings of the Fifth Annual DFRWS APAC Conference 2025! 欢迎参加2025年第五届亚太地区DFRWS年会论文集！

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301989

Mariya Shafat Kirmani

引用次数: 0

Creating a standardized corpus for digital stratigraphic methods with fsstratify 使用fsstratify为数字地层学方法创建标准化语料库

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301986

Julian Uthoff , Lisa Marie Dreier , Martin Lambertz , Mariia Rybalka , Felix Freiling

{"title":"Creating a standardized corpus for digital stratigraphic methods with fsstratify","authors":"Julian Uthoff , Lisa Marie Dreier , Martin Lambertz , Mariia Rybalka , Felix Freiling","doi":"10.1016/j.fsidi.2025.301986","DOIUrl":"10.1016/j.fsidi.2025.301986","url":null,"abstract":"<div><div>Digital stratigraphic methods aim to infer new information about digital objects using their depositional context. Many such methods have been developed, for example, to interpret file allocation traces and thereby estimate timestamps of file fragments based on their position on disk. Such methods are difficult to compare. We therefore present a corpus of NTFS file system images that can be used to evaluate these methods. The corpus comprises different categories, each extensively employing a small subset of file system operations to display their effect on file allocation traces. We demonstrate the usefulness of this corpus by evaluating the method of Bahjat and Jones (2019) that derives the timestamp of a file fragment from the timestamps of neighboring files. The corpus was generated using a revised version of <span>fsstratify</span>, a software framework to simulate file system usage. The tool is able to log the position of content data during file creation, greatly facilitating research in the realm of digital stratigraphy.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"54 ","pages":"Article 301986"},"PeriodicalIF":2.2,"publicationDate":"2025-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424404","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DFRWS EU 2026 Sweden

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/S2666-2817(25)00155-6

引用次数: 0

Advanced Monero wallet forensics: Demystifying off-chain artifacts to trace privacy-preserving cryptocurrency transactions 高级门罗币钱包取证：揭开链下工件的神秘面纱，追踪保护隐私的加密货币交易

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301988

Jeongin Lee, Geunyeong Choi, Jihyo Han, Jungheum Park

{"title":"Advanced Monero wallet forensics: Demystifying off-chain artifacts to trace privacy-preserving cryptocurrency transactions","authors":"Jeongin Lee, Geunyeong Choi, Jihyo Han, Jungheum Park","doi":"10.1016/j.fsidi.2025.301988","DOIUrl":"10.1016/j.fsidi.2025.301988","url":null,"abstract":"<div><div>Monero, a privacy-preserving cryptocurrency, employs advanced cryptographic techniques to obfuscate transaction participants and amounts, thereby achieving strong untraceability. However, digital forensic approach can still reveal sensitive information by examining off-chain artifacts such as memory and wallet files. In this work, we conduct an in-depth forensic analysis of Monero's wallet application, focusing on the handling of public and private keys and the wallet's data storage formats. We reveal how these keys are managed in memory and develop a memory scanning algorithm capable of identifying key-related data structures. Furthermore, we analyze the wallet keys and cache files, presenting a method for decrypting and interpreting serialized keys and transaction data encrypted with a user-specified passphrase. Our approach is implemented as an open-source Volatility3 plugin and a set of decryption scripts. Finally, we discuss the applicability of our methodology to multi-cryptocurrency wallets that incorporate Monero components, thereby validating the generalizability of our techniques.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"54 ","pages":"Article 301988"},"PeriodicalIF":2.2,"publicationDate":"2025-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DFRWS USA 2026 Arlington

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/S2666-2817(25)00159-3

引用次数: 0

Automatically generating digital forensic reference data triggered by mobile application updates 自动生成由移动应用程序更新触发的数字取证参考数据

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301985

Angelina A. Claij-Swart , Erik Oudsen , Bouke Timbermont , Christopher Hargreaves , Lena L. Voigt

引用次数: 0

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301977

Samantha Klier, Harald Baier

{"title":"Media source similarity hashing (MSSH): A practical method for large-scale media investigations","authors":"Samantha Klier, Harald Baier","doi":"10.1016/j.fsidi.2025.301977","DOIUrl":"10.1016/j.fsidi.2025.301977","url":null,"abstract":"<div><div>Hash functions play a crucial role in digital forensics to mitigate data overload. In addition to traditional cryptographic hash functions, similarity hashes - also known as approximate matching schemes - have emerged as effective tools for identifying media files with similar content. However, despite their relevance in investigative settings, a fast and practical method for identifying files originating from similar sources is still lacking. For example, in Child Sexual Abuse Material (CSAM) investigations, it is critical to distinguish between downloaded and potentially self-produced material. To address this gap, we introduce a Media Source Similarity Hash (MSSH), using JPEG images as a case study. MSSH leverages structural features of media files, converting them efficiently into Similarity Digests using n-gram representations. As such, MSSH constitutes the first syntactic approximate matching scheme. We evaluate the MSSH using our publicly available source code across seven datasets. The method achieves AUC scores exceeding 0.90 for native images — across device-, model-, and brand-level classifications, though the strong devicelevel performance likely reflects limitations in existing datasets rather than generalizable capability — and over 0.85 for samples obtained from social media platforms. Despite its lightweight design, MSSH delivers a performance comparable to that of resourceintensive, established Source Camera Identification (SCI) approaches, and surpasses them on a modern dataset, achieving an AUC of 0.97 compared to their AUCs, which range from 0.74 to 0.94. These results underscore MSSH's effectiveness for media source analysis in digital forensics, while preserving the speed and utility advantages typical of hash-based methods.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"54 ","pages":"Article 301977"},"PeriodicalIF":2.2,"publicationDate":"2025-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424489","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis 为评估基于法学硕士的数字法医时间线分析提供标准化的方法和数据集

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-10-01 Epub Date: 2025-11-03 DOI: 10.1016/j.fsidi.2025.301982

Hudan Studiawan , Frank Breitinger , Mark Scanlon

{"title":"Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis","authors":"Hudan Studiawan , Frank Breitinger , Mark Scanlon","doi":"10.1016/j.fsidi.2025.301982","DOIUrl":"10.1016/j.fsidi.2025.301982","url":null,"abstract":"<div><div>Large language models (LLMs) have widespread adoption in many domains, including digital forensics. While prior research has largely centered on case studies and examples demonstrating how LLMs can assist forensic investigations, deeper explorations remain limited, i.e., a standardized approach for precise performance evaluations is lacking. Inspired by the NIST Computer Forensic Tool Testing Program, this paper proposes a standardized methodology to quantitatively evaluate the application of LLMs for digital forensic tasks, specifically in timeline analysis. The paper describes the components of the methodology, including the dataset, timeline generation, and ground truth development. In addition, the paper recommends the use of BLEU and ROUGE metrics for the quantitative evaluation of LLMs through case studies or tasks involving timeline analysis. Experimental results using ChatGPT demonstrate that the proposed methodology can effectively evaluate LLM-based forensic timeline analysis. Finally, we discuss the limitations of applying LLMs to forensic timeline analysis.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"54 ","pages":"Article 301982"},"PeriodicalIF":2.2,"publicationDate":"2025-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424400","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0