ChatGPT for digital forensic investigation: The good, the bad, and the unknown
Open accessAbstract
The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Scanlon et al. (2023) assesses the applicability of ChatGPT for digital forensics, using it to determine if a file has been downloaded to a PC and if it has been executed by a specific user, and to detect browser history, Windows event logs, and interactions with cloud platform machines.
“Scanlon et al. (2023) assesses the applicability of ChatGPT for digital forensics. ChatGPT is used to help determine if a file has been downloaded to a PC and if the file has been executed by a specific user. In addition, ChatGPT is also used to detect browser history, Windows event logs, and interactions with cloud platform machines.”
From When LLMs meet cybersecurity: a systematic literature review (2025) · cites this paper as Scanlon et al. (2023)
Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Jakubův, J., Chvalovský, K., Goertzel, Z., et al. (2023) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.itp.2023.19 · Cited by 76,648 · see citing works
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 48,293 · see citing works
Hinton, G., Deng, L., Yu, D., Dahl, G., Mohamed, A.-R., Jaitly, N., Senior, A., Vanhoucke, V., Nguyen, P., Sainath, T., et al. (2012) · IEEE Signal Processing Magazine · doi:10.1109/msp.2012.2205597 · Cited by 10,260 · see citing works
XLNet: Generalized Autoregressive Pretraining for Language Understanding
Yang, Z., Dai, Z., Yang, Y., Carbonell, J., Salakhutdinov, R., & Le, Q. V. (2019) · arXiv · doi:10.48550/arxiv.1906.08237 · Cited by 6,687 · see citing works
(2023) · doi:10.1126/science · Cited by 6,063 · see citing works
Dwivedi, Y. K., Kshetri, N., Hughes, L., Slade, E. L., Jeyaraj, A., Kar, A. K., Baabdullah, A. M., Koohang, A., Raghavan, V., Ahuja, M., et al. (2023) · International Journal of Information Management · doi:10.1016/j.ijinfomgt.2023.102642 · Cited by 4,584 · see citing works
Artificial hallucinations in ChatGPT: implications in scientific writing
Alkaissi, H., & McFarlane, S. I. (2023) · Cureus · doi:10.7759/cureus.35179 · Cited by 1,540 · see citing works
ChatGPT is fun, but not an author
Thorp, H. H. (2023) · Science · doi:10.1126/science.adg7879 · Cited by 1,437 · see citing works
Proceedings of 10th International Conference on Availability, Reliability and Security (ARES 2015)
Schut, H., Scanlon, M., Farina, J., et al. (2015) · Cited by 162 · see citing works
Self-citationDu, X., Hargreaves, C. J., Sheppard, J., Anda, F., Sayakkara, A., Le‐Khac, N., & Scanlon, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3407068 · Cited by 120 · see citing works
Self-citationForensic Science International: Digital InvestigationPreprint
Davies, S. R. H., Macfarlane, R., & Buchanan, W. J. (2020) · arXiv (Cornell University) · Cited by 89 · see citing works
TraceGen: User activity emulation for digital forensic test image generation
Du, X., Hargreaves, C. J., Sheppard, J., et al. (2021) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2021.301133 · Cited by 33 · see citing works
Self-citationEviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution
Scanlon, M., Du, X., & Lillis, D. (2017) · Digital Investigation · doi:10.1016/j.diin.2017.01.010 · Cited by 32 · see citing works
Self-citationHsueh, P.-Y. S., & Moore, J. C. (2007) · The Association for Computational Linguistics · Cited by 27 · see citing works
Kanta, A., Coray, S., Coisel, I., et al. (2021) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2021.301186 · Cited by 27 · see citing works
ForTrace - A holistic forensic data set synthesis framework
Göbel, T., Maltan, S., Türr, J., et al. (2022) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2022.301344 · Cited by 24 · see citing works
Digital forensic investigation in the age of ChatGPT
Scanlon, M., Nikkel, B. J., & Geradts, Z. (2023) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2023.301543 · Cited by 19 · see citing works
Self-citationA Term Distribution Visualization Approach to Digital Forensic String Search
Schwartz, M., & Liebrock, L. M. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85933-8_4 · Cited by 10 · see citing works
The importance of text searches in digital forensics
Forte, D. V. (2004) · Network Security · doi:10.1016/s1353-4858(04)00067-4 · Cited by 8 · see citing works
Hargreaves, C. J. (2017) · doi:10.1002/9781118689196.ch6 · Cited by 4 · see citing works
Self-citation“Cyber World” as a Theme for a University-wide First-year Common Course
Przyborski, K., Breitinger, F., Beck, L., et al. (2020) · ASEE Annual Conference & Exposition · doi:10.18260/1-2--31923 · Cited by 4 · see citing works
Self-citationE-discovery: Creating and Managing an Enterprisewide Program
(2009) · Elsevier eBooks · doi:10.1016/b978-1-59749-296-6.x0001-6 · Cited by 2 · see citing works
Data Identification and Search Techniques
(2009) · Elsevier eBooks · doi:10.1016/b978-1-59749-296-6.00008-0 · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 4
- Bloom, B., 1956. Taxonomy of Educational Objectives: the Classification of Educational Goals. Taxonomy of Educational Objectives: the Classification of Educational Goals. David McKay Company. ISBN 9780582280106. http://refhub.elsevier.com/S2666-2817(2300121-X/sref3)
- Lallie, H.S., 2010. The use of digital forensic case studies for teaching and assessment. Cybercrime Forensics Education and Training 1 -9. http://refhub.elsevier.com/S2666-2817(2300121-X/sref16)
- Moch, C., Freiling, F.C., 2012. Evaluating the forensic image generator generator. In: Digital Forensics and Cyber Crime: Third International ICST Conference, ICDF2C 2011. Springer, Dublin, Ireland, pp. 238 -252. October 26-28, 2011, Revised Selected Papers 3. http://refhub.elsevier.com/S2666-2817(2300121-X/sref20)
- Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Lu, Kaiser, Polosukhin, I., 2017. Attention is all you need. In: Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., Garnett, R. (Eds.), Advances in Neural Information Processing Systems, 30. Curran Associates, Inc. http://refhub.elsevier.com/S2666-2817(2300121-X/sref28)
Cited by
Sorted by citations
A survey on large language model (LLM) security and privacy: The Good, The Bad, and The Ugly
Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z., & Zhang, Y. (2024) · High-Confidence Computing · doi:10.1016/j.hcc.2024.100211 · Cited by 1,083 · see citing works
When LLMs meet cybersecurity: a systematic literature review
Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., & Meng, D. (2025) · Cybersecurity · doi:10.1186/s42400-025-00361-w · Cited by 220 · see citing works
Large Language Models for Cyber Security: A Systematic Literature Review
Xu, H., Wang, S., Li, N., Wang, K., Zhao, Y., Chen, K., Yu, T., Liu, Y., & Wang, H. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3769676 · Cited by 189 · see citing works
Jaffal, N. O., Alkhanafseh, M., & Mohaisen, D. (2025) · AI · doi:10.3390/ai6090216 · Cited by 69 · see citing works
Beyzavi, H., Shiraskar, S., Albluwi, A., Albalawi, M., Rizk, D., Rizk, F., Rizk, P., Nehmetallah, G., Rizk, R., & Santosh, K. (2026) · 2026 IEEE Conference on Artificial Intelligence (CAI) · doi:10.1109/cai68641.2026.11536239
- Authors
- Scanlon, M., Breitinger, F., Hargreaves, C., Hilgert, J.-N., & Sheppard, J.
- Affiliations
- University College Dublin (IE)
- University of Lausanne (CH)
- University of Oxford (GB)
- Fraunhofer Institute for Communication, Information Processing and Ergonomics (DE)
- South East Technological University (IE)
- Corresponding author
- Scanlon, Mark
- Venue
- Forensic Science International: Digital Investigation
- Publisher
- Elsevier BV
- Published
- 2023-10
- Volume
- 46
- Pages
- 301609
- ISSN
- 2666-2817 (ISSN-L)
- OpenAlex
- W4387610430
- Cited by
- 118
- References
- 24
- Citations by year
- 2026: 22 · 2025: 46 · 2024: 45 · 2023: 5
- FWCI
- 27.69
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Forensic Science International Digital Investigation (publishedVersion, cc-by-nc-nd)
- Preprints.org (acceptedVersion, cc-by)
- arXiv (Cornell University) (submittedVersion)
- SERVAL (Université de Lausanne) (submittedVersion, cc-by-nc-nd)
- OPUS (Augsburg University) (submittedVersion, cc-by-nc-nd)
- IRIS (submittedVersion, cc-by-nc-nd)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Authorship Attribution and Profiling
- Keywords
- ChatGPT, GPT-4, large language models, digital forensics, evidence retrieval, code generation, anomaly detection, incident response, digital forensics education
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
