Forensic Science International-Digital Investigation最新文献

{"title":"REPDF: Repairing corrupted PDF files through font mapping and object relationship reconstruction","authors":"Seungeun Park,&nbsp;Byeongchan Jeong,&nbsp;Jieon Kim,&nbsp;Jungheum Park","doi":"10.1016/j.fsidi.2026.302061","DOIUrl":"10.1016/j.fsidi.2026.302061","url":null,"abstract":"<div><div>PDF is widely used as the standard for digital records across administrative, legal, academic, and business domains owing to its portability and structural consistency. As the volume of PDF documents continues to grow, they are increasingly collected as evidence in digital forensic investigations. However, the complex and hierarchical structure of the PDF file format poses significant challenges when repairing files that are corrupted. In this study, we propose a novel PDF repair framework that automatically reconstructs object relationships along with a pre-constructed font database, enabling effective repair even when embedded fonts or Unicode mappings are missing. To evaluate its performance, we generate a corpus of 1,000 PDF files covering ten real-world corruption scenarios, multiple languages, and different PDF creation methods. Experimental results show an average text recovery rate of 90.67 %, along with successful image recovery, demonstrating superior performance compared to existing PDF repair tools.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302061"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Large language models in digital forensics: capabilities, challenges and future directions","authors":"Maxim Chernyshev,&nbsp;Zubair Baig,&nbsp;Naeem Syed,&nbsp;Robin Doss,&nbsp;Malcolm Shore","doi":"10.1016/j.fsidi.2025.302043","DOIUrl":"10.1016/j.fsidi.2025.302043","url":null,"abstract":"<div><div>The rapid advancement of large language models (LLMs) has simultaneously created opportunities and challenges for digital forensic science. This survey systematically examines the emerging intersection between generative artificial intelligence and digital forensics through our analysis of 33 peer-reviewed works. We map LLM capabilities across the established Digital Forensic Research Workshop (DFRWS) process model, identifying three strategic integration points where these technologies demonstrate measurable benefits – pattern recognition during the examination phase, evidence analysis during the analysis phase, and evidence presentation and reporting during the presentation phase. Our findings show that LLMs achieve substantial performance improvements across diverse forensic tasks, but critical challenges persist, including the fundamental tension between the probabilistic nature of LLM outputs and deterministic forensic requirements, alongside concerns regarding explainability, reproducibility, and legal admissibility. We identify significant research gaps in validation frameworks, forensic-ready architectures, and standardised evaluation protocols. The survey establishes a comprehensive research agenda spanning technical, methodological, and legal domains, emphasising the necessity for interdisciplinary collaboration and human-AI collaborative approaches to preserve forensic integrity when leveraging LLM capabilities.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302043"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145926262","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"FOREST: Inspecting and tracking RESTful APIs for constructing a cloud forensic knowledge base","authors":"Byeongchan Jeong,&nbsp;Jieon Kim,&nbsp;Sangjin Lee,&nbsp;Jungheum Park","doi":"10.1016/j.fsidi.2026.302070","DOIUrl":"10.1016/j.fsidi.2026.302070","url":null,"abstract":"<div><div>Modern cloud-based services increasingly rely on RESTful APIs to manage user data. However, many of these APIs are undocumented and frequently change without notice, posing challenges to digital forensic investigations. First, undocumented APIs may expose forensic-relevant data while bypassing standard access logging. Second, frequent structural changes hinder reproducible and verifiable evidence acquisition. To address these challenges, we present FOREST, a framework for the automated discovery, analysis, and tracking of RESTful API behavior in real-world cloud environments. FOREST analyzes live API traffic generated through natural user interactions, identifies undocumented endpoints, extracts artifact-bearing responses, and generates OpenAPI Specifications. It also supports longitudinal schema comparison and parameter dependency analysis to ensure consistent data acquisition across service versions. We evaluate FOREST on Microsoft OneDrive, Microsoft Teams, and Mattermost. The results demonstrate its effectiveness in uncovering undocumented APIs, tracing structural API changes, and supporting reliable forensic analysis in dynamic cloud service environments.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302070"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Examining black-box forensic tools in digital vehicle forensics: Capabilities, limitations, and practical implications","authors":"Kevin Mayer","doi":"10.1016/j.fsidi.2026.302067","DOIUrl":"10.1016/j.fsidi.2026.302067","url":null,"abstract":"<div><div>Proprietary “black-box” forensic tools such as Bosch Crash Data Retrieval (CDR) and Berla iVe are widely deployed in vehicle event data recorder (EDR) and infotainment system investigations. While they offer rapid acquisition, broad hardware coverage, and outputs tailored for legal contexts, their internal decoding logic is opaque and complex to validate independently. This paper presents two controlled demonstrations simulating typical extraction scenarios: (1) EDR field completeness and temporal alignment testing, and (2) infotainment data completeness and parsing accuracy across simulated tool variants. In Demonstration 1, black-box output exhibited quantization, timestamp offsets, and missing fields that could materially alter accident reconstruction. In Demonstration 2, simulated GPS track extractions demonstrated spatial downsampling, coordinate rounding, and timezone misinterpretation, each of which could undermine cross-source correlation. Benefits, challenges, and limitations of commercial automotive forensic tools are discussed, alongside recommendations for independent validation, open-source crosschecks, and forensic quality assurance standards. The results underscore the importance of transparent methodologies and reproducible testing in the use of proprietary automotive forensic solutions.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302067"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395557","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Enhancing abnormality identification: Robust out-of-distribution strategies for deepfake detection","authors":"Luca Maiano,&nbsp;Fabrizio Casadei,&nbsp;Irene Amerini","doi":"10.1016/j.fsidi.2026.302062","DOIUrl":"10.1016/j.fsidi.2026.302062","url":null,"abstract":"<div><div>Detecting deepfakes has become a critical challenge in Computer Vision and Artificial Intelligence. Despite significant progress in detection techniques, generalizing them to open-set scenarios continues to be a persistent difficulty. Neural networks are often trained on the closed-world assumption, but with new generative models constantly evolving, it is inevitable to encounter data generated by models that are not part of the training distribution. To address these challenges, in this paper, we propose two novel Out-Of-Distribution (OOD) detection approaches. The first approach is trained to reconstruct the input image, while the second incorporates an attention mechanism for detecting OODs. Our experiments validate the effectiveness of the proposed approaches compared to existing state-of-the-art techniques. Our method achieves promising results in deepfake detection and ranks among the top-performing configurations on the benchmark, demonstrating their potential for robust, adaptable solutions in dynamic, real-world applications.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302062"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554555","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The investigator's friend and foe: A forensic analysis of GrapheneOS","authors":"Katharina De Rentiis,&nbsp;Julian Geus,&nbsp;Felix Freiling","doi":"10.1016/j.fsidi.2026.302048","DOIUrl":"10.1016/j.fsidi.2026.302048","url":null,"abstract":"<div><div>Due to differing hardware and software security mechanisms, the forensic analysis of smartphones is strongly device-dependent. Given their prevalence in forensic investigations, the research community and tool manufacturers have focused primarily on devices with standard Operating Systems (OSs) from major manufacturers. Consequently, privacy advocates promote devices based on highly configurable OSs, such as the Android Open Source Project (AOSP), or custom ROMs like GrapheneOS, which prioritize privacy and security. These OSs benefit investigators in both private use and covert investigations. However, they present a significant challenge when used by the opposing side. To properly assess the situation, we conduct the first forensic analysis of GrapheneOS: We give an overview of AOSP and the custom ROM ecosystem. We also explain security and privacy features of GrapheneOS and how they compare to Android's. Finally, we perform a data acquisition analysis, including tool support for GrapheneOS, and a network traffic analysis. Our results demonstrate that GrapheneOS improves upon Android security, and that its privacy features considerably complicate the remote acquisition of user data.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302048"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554587","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"AutoDFBench 1.0: A benchmarking framework for digital forensic tool testing and generated code evaluation","authors":"Akila Wickramasekara ,&nbsp;Tharusha Mihiranga ,&nbsp;Aruna Withanage ,&nbsp;Buddhima Weerasinghe ,&nbsp;Frank Breitinger ,&nbsp;John Sheppard ,&nbsp;Mark Scanlon","doi":"10.1016/j.fsidi.2026.302055","DOIUrl":"10.1016/j.fsidi.2026.302055","url":null,"abstract":"<div><div>The National Institute of Standards and Technology (NIST) Computer Forensic Tool Testing (CFTT) programme has become the <em>de facto</em> standard for providing digital forensic tool testing and validation. However to date, no comprehensive framework exists to automate benchmarking across the diverse forensic tasks included in the programme. This gap results in inconsistent validation, challenges in comparing tools, and limited validation reproducibility. This paper introduces AutoDFBench 1.0, a modular benchmarking framework that supports the evaluation of both conventional DF tools and scripts, as well as AI-generated code and agentic approaches. The framework integrates five areas defined by the CFTT programme: string search, deleted file recovery, file carving, Windows registry recovery, and SQLite data recovery. AutoDFBench 1.0 includes ground truth data comprising of 63 test cases and 10,968 unique test scenarios, and execute evaluations through a RESTful API that produces structured JSON outputs with standardised metrics, including precision, recall, and F1 score for each test case, and the average of these F1 scores becomes the <em>AutoDFBench Score</em>. The benchmarking framework is validated against CFTT's datasets. The framework enables fair and reproducible comparison across tools and forensic scripts, establishing the first unified, automated, and extensible benchmarking framework for digital forensic tool testing and validation. AutoDFBench 1.0 supports tool vendors, researchers, practitioners, and standardisation bodies by facilitating transparent, reproducible, and comparable assessments of DF technologies.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302055"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554543","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Plug to place: Indoor multimedia geolocation from electrical sockets for digital investigation","authors":"Kanwal Aftab ,&nbsp;Graham Adams ,&nbsp;Mark Scanlon","doi":"10.1016/j.fsidi.2026.302056","DOIUrl":"10.1016/j.fsidi.2026.302056","url":null,"abstract":"<div><div>Computer vision is a rapidly evolving field, giving rise to powerful new tools and techniques in digital forensic investigation, and shows great promise for novel digital forensic applications. One such application, indoor multimedia geolocation, has the potential to become a crucial aid for law enforcement in the fight against human trafficking, child exploitation, and other serious crimes. While outdoor multimedia geolocation has been widely explored, its indoor counterpart remains underdeveloped due to challenges such as similar room layouts, frequent renovations, visual ambiguity, indoor lighting variability, unreliable GPS signals, and limited datasets in sensitive domains.</div><div>This paper introduces a pipeline that uses electrical sockets as consistent indoor markers for geolocation, since plug socket types are standardised by country or region. The three-stage deep learning pipeline detects plug sockets (YOLOv11, [email protected] = 0.843), classifies them into one of 12 plug socket types (Xception, accuracy = 0.912), and maps the detected socket types to countries (accuracy = 0.96 at &gt;90 % threshold confidence). To address data scarcity, two dedicated datasets were created: socket detection dataset of 2328 annotated images expanded to 4074 through augmentation, and a classification dataset of 3187 images across 12 plug socket classes. The pipeline was evaluated on the Hotels-50K dataset, focusing on the TraffickCam subset of crowd-sourced hotel images, which capture real-world conditions such as poor lighting and amateur angles. This dataset provides a more realistic evaluation than using professional, well-lit, often wide-angle images from travel websites. This framework demonstrates a practical step toward real-world digital forensic applications. The code, trained models, and the data for this paper are available open source.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302056"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554545","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"LEMON: A universal eBPF-based volatile memory acquisition tool for modern android devices and hardened linux systems","authors":"Andrea Oliveri,&nbsp;Marco Cavenati,&nbsp;Stefano De Rosa,&nbsp;Sudharsun Lakshmi Narasimhan,&nbsp;Davide Balzarotti","doi":"10.1016/j.fsidi.2026.302045","DOIUrl":"10.1016/j.fsidi.2026.302045","url":null,"abstract":"<div><div>Acquiring volatile memory (RAM) from modern Linux and Generic Kernel Image (GKI) Android systems has become increasingly difficult due to recent hardening features such as Secure Boot, Kernel Lockdown, and strict module signing and loading policies. As a result, traditional open-source tools such as LiME and AVML are no longer viable, preventing the acquisition and analysis of complete physical memory dumps.</div><div>To address this limitation, we introduce LEMON, the first eBPF-based universal memory acquisition tool for both hardened Linux systems and modern GKI Android devices, extending the range of devices on which volatile memory acquisition is possible. LEMON <em>requires neither kernel source code, code signing, nor prior deployment</em>. It is compatible with <span>x86_64</span> and <span>ARM64</span> architectures and supports acquisition either to local storage or over the network in standard forensic file formats.</div><div>In this paper, we provide a detailed description of LEMON's implementation, compare it with state-of-the-art open-source acquisition tools, evaluate the byte-level atomicity of its dumps and its acquisition time against existing alternatives, and show the deployment and use of LEMON on two real GKI-equipped Android phones. Furthermore, to enable a complete memory forensics analysis chain on modern Android phones, we adapt a method for generating Volatility 3 profiles from BTF debug information emitted by the kernel at runtime. In a simulated scenario on a real phone, this enabled us to recover contact details from the volatile memory of a terminated password manager. The contact details were unavailable in persistent storage and entirely absent from the logs, contradicting the belief that disk forensics alone is sufficient to extract all relevant evidence from an Android device.</div><div>Finally, in the spirit of open science and to support the forensics community, we release LEMON as an open-source project.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302045"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554581","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"DFRWS EU 2027 Edinburgh","authors":"","doi":"10.1016/S2666-2817(26)00044-2","DOIUrl":"10.1016/S2666-2817(26)00044-2","url":null,"abstract":"","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302087"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554637","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}