Forensic Science International-Digital Investigation最新文献_第8页

Integrated validation framework for EDR data reliability: Application to Korean traffic accident cases EDR数据可靠性集成验证框架：在韩国交通事故案例中的应用

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-02-10 DOI: 10.1016/j.fsidi.2026.302071

Youngsoo Choi , Jongjin Park , Seung-Hyun Kong

{"title":"Integrated validation framework for EDR data reliability: Application to Korean traffic accident cases","authors":"Youngsoo Choi , Jongjin Park , Seung-Hyun Kong","doi":"10.1016/j.fsidi.2026.302071","DOIUrl":"10.1016/j.fsidi.2026.302071","url":null,"abstract":"<div><div>The importance of digital evidence in traffic accident analysis is continuously increasing. Among them, Event Data Recorder (EDR) data is widely used as critical evidence in traffic accident investigations. However, in Korea, social questions about the reliability of the data itself continue to be raised due to the uncertainty of the recording time (Time Zero) of EDR data. In this study, we proposed a framework for the systematic validation of EDR data and developed a practical program. We cross-validated EDR data using various information from Dashboard Camera (DBC) installed in most vehicles in Korea. By applying the framework to traffic accidents that occurred in Korea, we compared the calculated Principal Direction of Force (PDOF) with actual vehicle damage patterns, verified engine status through audio signal analysis, and estimated Time Zero by extracting text from DBC and synchronizing temporal data. The proposed synchronization algorithm achieved average similarity scores of 0.978 for speed data and 0.83 for acceleration data across various collision scenarios. This framework objectively demonstrates the similarity between EDR and DBC data, improving the accuracy and reliability of traffic accident analysis. It is particularly valuable for controversial cases in Korea, such as suspected sudden unintended acceleration accidents.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302071"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395547","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Beyond the binary—navigating opaque systems and the privacy paradox 超越二进制导航的不透明系统和隐私悖论

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-02-20 DOI: 10.1016/j.fsidi.2026.302075

引用次数: 0

Resilience of forensic evidence acquisition under database schema drift 数据库模式漂移下法医证据获取的弹性

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302059

Afiqah M. Azahari, Andrea Oliveri, Davide Balzarotti

{"title":"Resilience of forensic evidence acquisition under database schema drift","authors":"Afiqah M. Azahari, Andrea Oliveri, Davide Balzarotti","doi":"10.1016/j.fsidi.2026.302059","DOIUrl":"10.1016/j.fsidi.2026.302059","url":null,"abstract":"<div><div>The reliability of mobile forensic analysis depends not only on the ability to extract application databases but also on the stability of the structures that organize user data. As Android applications evolve, their databases undergo continual schema modifications, which alter established acquisition workflows.</div><div>In this paper, we present the first longitudinal study of schema drift in Android mobile applications, examining 320 versions of 20 popular Android apps released between 2022 and 2025. By systematically extracting and analyzing their databases, we reveal how structural changes, ranging from incremental column additions to the removal of entire tables, shape the evidential landscape. We further assess the resilience of SQL-based forensic queries across versions, showing how even minor schema drift can invalidate extractions or may miss newly introduced artifacts. Our results demonstrate that communication and social media apps exhibit the most volatile schema evolution, while navigation, browser, and note-taking apps remain comparatively stable. These findings reveal a critical yet overlooked threat to evidential completeness, motivating the development of adaptive, drift-aware forensic tools that can anticipate and accommodate ongoing application evolution.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302059"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554552","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

VAAS: Vision-Attention Anomaly Scoring for image manipulation detection in digital forensics 数字取证中图像处理检测的视觉-注意力异常评分

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302063

Opeyemi Bamigbade , Mark Scanlon , John Sheppard

{"title":"VAAS: Vision-Attention Anomaly Scoring for image manipulation detection in digital forensics","authors":"Opeyemi Bamigbade , Mark Scanlon , John Sheppard","doi":"10.1016/j.fsidi.2026.302063","DOIUrl":"10.1016/j.fsidi.2026.302063","url":null,"abstract":"<div><div>Recent advances in AI-driven image generation have introduced new challenges for verifying the authenticity of digital evidence in forensic investigations. Modern generative models can produce visually consistent forgeries that evade traditional detectors based on pixel or compression artefacts. Most existing approaches also lack an explicit measure of anomaly intensity, which limits their ability to quantify the severity of manipulation. This paper introduces V<span>ision-</span>A<span>ttention</span> A<span>nomaly</span> S<span>coring</span> (VAAS), a novel dual-module framework that integrates global attention-based anomaly estimation using Vision Transformers (ViT) with patch-level self-consistency scoring derived from segmentation embeddings. The hybrid formulation provides a continuous and interpretable anomaly score that reflects both the location and degree of manipulation. Evaluations on the <em>DF2023</em> and <em>CASIA v2.0</em> datasets demonstrate that <span>vaas</span> achieves competitive F1 and IoU performance, while enhancing visual explainability through attention-guided anomaly maps. The framework bridges quantitative detection with human-understandable reasoning, supporting transparent and reliable image integrity assessment. The source code for all experiments and corresponding materials for reproducing the results are available open source.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302063"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554553","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Hey GPT-OSS, looks like you got it – Now walk me through it! An assessment of the reasoning language models chain of thought process for digital forensics 嘿，GPT-OSS，看起来你搞定了-现在告诉我！对数字取证的推理语言模型思维过程链的评估

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302052

Gaëtan Michelet, Janine Schneider, Aruna Withanage, Frank Breitinger

{"title":"Hey GPT-OSS, looks like you got it – Now walk me through it! An assessment of the reasoning language models chain of thought process for digital forensics","authors":"Gaëtan Michelet, Janine Schneider, Aruna Withanage, Frank Breitinger","doi":"10.1016/j.fsidi.2026.302052","DOIUrl":"10.1016/j.fsidi.2026.302052","url":null,"abstract":"<div><div>Large language models (LLMs), including systems such as ChatGPT, are increasingly examined for their role in digital forensics. Current research not only surveys their potential applications but also investigates how fine-tuning and model adaptation can enhance performance on specialized forensic tasks. However, the understandability and interpretability of the results (outputs) reduce their operational and legal usability. Recently, a new class of reasoning language models has emerged, designed to handle logic-based tasks through an ‘internal reasoning’ mechanism. Yet, users typically only see the final answer, not the underlying reasoning. One of these reasoning models is gpt-oss, which can be deployed locally, providing full access to its underlying reasoning process. This article presents the first investigation into the potential of reasoning language models for digital forensics. Four test use cases are examined to assess the usability of the reasoning component in supporting results understandability. The evaluation combines a new quantitative metric with qualitative analysis. Findings show that the reasoning component aids in understanding, interpreting, and validating LLM outputs in digital forensics at medium reasoning levels, but the support is often limited, and higher reasoning levels do not enhance response quality.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302052"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554640","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Inside the black box: In-depth analysis of geolocation mechanisms in android mobile devices 黑盒子内部：深入分析android移动设备中的地理定位机制

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302046

Samuele Mombelli, Thomas R. Souvignet

{"title":"Inside the black box: In-depth analysis of geolocation mechanisms in android mobile devices","authors":"Samuele Mombelli, Thomas R. Souvignet","doi":"10.1016/j.fsidi.2026.302046","DOIUrl":"10.1016/j.fsidi.2026.302046","url":null,"abstract":"<div><div>Geolocation traces extracted from mobile devices are increasingly used as critical evidence in forensic investigations, offering insights into user activity and physical presence. Yet, the opaque nature of geolocation processes—especially those relying on proprietary components—creates major challenges in assessing their provenance, accuracy, and reliability, and increases the risk of misinterpretation. This work investigates the internal mechanisms implemented by Android's Fused Location Provider (FLP)—the core geolocation framework used by most Android devices today—through reverse engineering, dynamic testing and forensic analysis. It details how multiple sources of location data are fused into location fixes, and how contextual parameters influence geolocation calculations. The study also uncovers a set of previously undocumented local traces of geolocation activity, analyzing their structure, persistence, and forensic potential. Our findings highlight the complexity and adaptive nature of Android's geolocation system and provide a technical foundation for the forensic interpretation of geolocation traces on Android devices.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302046"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554641","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DroPTC: Sentence-level drone flight log forensics using contrastive learning and explainable AI DroPTC：句子级无人机飞行日志取证使用对比学习和可解释的人工智能

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302051

Swardiantara Silalahi , Tohari Ahmad , Hudan Studiawan , Frank Breitinger

{"title":"DroPTC: Sentence-level drone flight log forensics using contrastive learning and explainable AI","authors":"Swardiantara Silalahi , Tohari Ahmad , Hudan Studiawan , Frank Breitinger","doi":"10.1016/j.fsidi.2026.302051","DOIUrl":"10.1016/j.fsidi.2026.302051","url":null,"abstract":"<div><div>Unmanned Aerial Vehicles (UAVs), commonly known as drones, are increasingly deployed across diverse application domains, raising critical challenges for digital forensic investigation following safety incidents and system failures. In drone investigations, systematic analysis of flight logs is essential for reconstructing events, identifying root causes, and supporting reliable incident attribution and risk mitigation. Because a message may contain multiple sentences, message-level analysis cannot precisely pinpoint which log segment indicates a problem. Therefore, this paper proposes DroPTC (<strong>Dro</strong>ne <strong>P</strong>roblem <strong>T</strong>ype <strong>C</strong>lassifier), an end-to-end framework to identify and classify problems at the sentence level. A rule-based segmenter is designed to segment log messages into sentences based on historical log characteristics. Using the resulting log sentences, a pre-trained embedding is fine-tuned using contrastive learning for semantic alignment. The integrated gradient is employed to enhance the model's interpretability, enabling admissible and trustworthy analysis. Sentence deduplication is utilized to identify unique log events, thereby reducing the analyst workload. Quantitative and qualitative analysis of the experimental results show that DroPTC outperforms the baselines in three aspects: performance, trustworthiness, and efficiency. This paper also presents a working open-source tool as the tested implementation of the proposed framework. The tool accepts the decrypted flight log file and produces a forensic report in HTML and PDF format.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302051"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554639","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Needle in a case: Scalable search over large-scale image corpora in forensic applications 案件中的针：在法医应用中大规模图像语料库上的可扩展搜索

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302057

Kamil Faber , Dominik Żurek , Kacper Bujak , Monika Selegrat , Kamil Piętak

{"title":"Needle in a case: Scalable search over large-scale image corpora in forensic applications","authors":"Kamil Faber , Dominik Żurek , Kacper Bujak , Monika Selegrat , Kamil Piętak","doi":"10.1016/j.fsidi.2026.302057","DOIUrl":"10.1016/j.fsidi.2026.302057","url":null,"abstract":"<div><div>The rapid growth of digital content has made images a key form of communication, which also extends into criminal contexts, where visual material often constitutes critical evidence. Forensic analysts face the challenge of locating relevant images within large, heterogeneous datasets, such as those extracted from mobile devices. Manual inspection of such data is time-consuming and inefficient. Although traditional automated classification methods offer partial support, they remain constrained by predefined class sets, limiting their applicability in the dynamic and unpredictable nature of real forensic investigations. Recent advances in artificial intelligence (AI) have introduced models capable of retrieving images using natural-language queries, enabling more universal and adaptive search capabilities. In this work, we conduct a comprehensive evaluation of two modern AI paradigms for large-scale forensic image retrieval: Vision–Language Models (VLMs), which generate searchable textual captions of images, and Contrastive Language–Image Pre-training (CLIP), which performs embedding-based text–image similarity search.</div><div>To the best of our knowledge, this is the first systematic comparison of these approaches in a forensic context. We evaluate 33 representative queries across three forensic use cases and nine heterogeneous datasets comprising over 80 000 images. Our results offer new insights into the trade-offs between caption-based and embedding-based retrieval methods and their applicability in practical digital forensic workflows.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302057"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554548","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Addressing the dataset gap problem with Generative AI: Towards LLM-driven forensic scenarios for dataset generation 用生成式人工智能解决数据集缺口问题：面向数据集生成的法学硕士驱动的取证场景

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302053

Michael Plankl , Thomas Göbel , Harald Baier

{"title":"Addressing the dataset gap problem with Generative AI: Towards LLM-driven forensic scenarios for dataset generation","authors":"Michael Plankl , Thomas Göbel , Harald Baier","doi":"10.1016/j.fsidi.2026.302053","DOIUrl":"10.1016/j.fsidi.2026.302053","url":null,"abstract":"<div><div>The increasing amount of incriminating data to be analysed on the one hand and the limited availability of forensic datasets on the other hand complicate forensic research as well as the development and validation of forensic tools. This challenge is often referred to as the <em>dataset gap problem</em>. A novel and promising approach to solve the dataset gap problem is the generation of synthetic, forensic scenarios through the application of Generative AI (GenAI) approaches like Large Language Models (LLMs). In this paper, we demonstrate how to use popular, general-purpose foundation models to generate various forensic artefacts. While emphasising the benefits of an LLM-driven dataset generation, we also address in detail inherent risks that can impair data synthesis using LLMs (e.g., hallucinations, limited explainability, stochastic model behaviour) and show how to compensate for these limitations (e.g., skilful use of prompt engineering and architectural patterns such as function calling and AI agents). In addition, we prove the practicability of our approach by enhancing a recent data synthesis framework with LLM capabilities and a user-friendly interface. Consequently, we are able to use GenAI to automatically generate configuration files for various forensically coherent scenarios and the resulting datasets. Our implementation thus demonstrates the potential of an automated, prompt-driven scenario generation process, thereby presenting a scalable solution to the shortage of forensic dataset availability.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302053"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554643","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

REVEAL: A large-scale comprehensive image dataset for steganalysis REVEAL：用于隐写分析的大规模综合图像数据集

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-10-29 DOI: 10.1016/j.fsidi.2025.302006

Meike Kombrink , Stijn van Lierop , Dionne Stolwijk , Marcel Worring , Derk Vrijdag , Zeno Geradts

{"title":"REVEAL: A large-scale comprehensive image dataset for steganalysis","authors":"Meike Kombrink , Stijn van Lierop , Dionne Stolwijk , Marcel Worring , Derk Vrijdag , Zeno Geradts","doi":"10.1016/j.fsidi.2025.302006","DOIUrl":"10.1016/j.fsidi.2025.302006","url":null,"abstract":"<div><div>Detection methodologies for steganography are a topic of study both within academia and in law enforcement. For the development of detection methods and the validation of their use for law enforcement, a large-scale representative dataset is essential. Current datasets are lacking in terms of representing real-life steganography, as they only include low resolution images, are taken with only a few different cameras, and are validated with only a minimal number of steganography methods. A new large-scale comprehensive image steganography dataset is needed with many typical examples of steganography one could encounter in casework. To that end, we present the REVEAL dataset containing 100.006 images taken with more than 50 different cameras. The set contains a rich variety of images, the attributes of which have a wide distribution. There are for example over 200 different sizes, ranging from 256x256 to 7680x4320. All 100.006 images have then been subjected to many different chains of image preprocessing steps. After the preprocessing, a total of more than 50 different image steganography algorithms were used to hide information in the images. This results in three image sets namely: original, preprocessed, and stego, in total more than 300.000 images. This properly annotated dataset can help to achieve accurate detection using supervised machine-learning based methods. At the same time, this dataset can be used for both forensic evaluation and validation, thus improving the applicability of detection methods. The dataset with full annotations, algorithms, and results is made publicly available.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302006"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145424629","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0