Large language models in digital forensics: capabilities, challenges and future directions
Open accessAbstract
The rapid advancement of large language models (LLMs) has simultaneously created opportunities and challenges for digital forensic science. This survey systematically examines the emerging intersection between generative artificial intelligence and digital forensics through our analysis of 33 peer-reviewed works. We map LLM capabilities across the established Digital Forensic Research Workshop (DFRWS) process model, identifying three strategic integration points where these technologies demonstrate measurable benefits – pattern recognition during the examination phase, evidence analysis during the analysis phase, and evidence presentation and reporting during the presentation phase. Our findings show that LLMs achieve substantial performance improvements across diverse forensic tasks, but critical challenges persist, including the fundamental tension between the probabilistic nature of LLM outputs and deterministic forensic requirements, alongside concerns regarding explainability, reproducibility, and legal admissibility. We identify significant research gaps in validation frameworks, forensic-ready architectures, and standardised evaluation protocols. The survey establishes a comprehensive research agenda spanning technical, methodological, and legal domains, emphasising the necessity for interdisciplinary collaboration and human-AI collaborative approaches to preserve forensic integrity when leveraging LLM capabilities.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The C2PA specification defines interoperable manifests and verification semantics across heterogeneous ecosystems, yet leaves deterministic enhancement control and ROI-bounded lineage preservation largely outside its direct scope.
“The dominant standards-oriented framework in this area is the C2PA specification, which defines interoperable manifests and verification semantics across heterogeneous ecosystems, yet leaves deterministic enhancement control and ROI-bounded lineage preservation largely outside its direct scope [9].”
Cites
Preferred reporting items for systematic reviews and meta-analyses: The PRISMA statement
Moher, D., Liberati, A., Tetzlaff, J., & Altman, D. G. (2010) · International Journal of Surgery · doi:10.1016/j.ijsu.2010.02.007 · Cited by 12,156 · see citing works
Lost in the Middle: How Language Models Use Long Contexts
Liu, N. F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F., & Liang, P. (2024) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00638 · Cited by 1,612 · see citing works
The Porter stemming algorithm: then and now
Willett, P. (2006) · Data Technologies and Applications · doi:10.1108/00330330610681295 · Cited by 409 · see citing works
Reconciling deep learning with symbolic artificial intelligence: representing objects and relations
Garnelo, M., & Shanahan, M. (2019) · Current Opinion in Behavioral Sciences · doi:10.1016/j.cobeha.2018.12.010 · Cited by 255 · see citing works
Loumachi, F. Y., Ghanem, M. C., & Ferrag, M. A. (2025) · Computers · doi:10.3390/computers14020067 · Cited by 40 · see citing works
Handling chat data in the age of the AI investigator
Kahvedžić, D. (2024) · ERA Forum · doi:10.1007/s12027-025-00827-x · Cited by 2 · see citing works
Privacy Enhancing Technologies for Intelligent Healthcare: Research Challenges and Opportunities
Khan, F. A., Shah, S. A., Tahir, S., Ghadi, Y. Y., Shah, S. I., Zahid, A., Ahmad, J. E., & Abbasi, Q. H. (2025) · ACM Computing Surveys · doi:10.1145/3771543 · Cited by 2 · see citing works
Flagged first, then by citations
Research works printed but not linked: 17
- Al-Dhaqm, 2021, Digital forensics subdomains: the state of the art and future directions, vol. 9, 152476
- Casino, 2022, Research trends, challenges, and emerging topics in digital forensics: a review of reviews, vol. 10, 25464
- Cho, 2025, Conversational AI forensics: a case study on ChatGPT, Gemini, Copilot, and Claude, Forensic Sci. Int. Digit. Investig., 52
- Cho, 2024, Exploring the potential of large language models for author profiling tasks in digital text forensics, Forensic Sci. Int. Digit. Investig., 50
- Fayyaz, 2024, A hybrid artificial intelligence framework for enhancing digital forensic investigations of infotainment systems, Forensic Sci. Int. Digit. Investig., 49
- Henseler, 2023, ChatGPT as a Copilot for investigating digital evidence, LegalAIIA@ ICAIL, 58
- Kim, 2025, Your forensic AI-assistant, SERENA: systematic extraction and reconstruction for enhanced A2P message forensics, Forensic Sci. Int. Digit. Investig., 53
- Kim, 2025, Digital forensics in law enforcement: a case study of LLM-driven evidence analysis, Forensic Sci. Int. Digit. Investig., 54
- Michelet, 2024, ChatGPT, llama, can you write my report? an experiment on assisted digital forensics reports written using (local) large language models, Forensic Sci. Int.: Digit. Investig., 48
- Oh, 2024, volGPT: evaluation on triaging ransomware process in memory forensics with large language model, Forensic Sci. Int.: Digit. Investig., 49
- Scanlon, 2023, ChatGPT for digital forensic investigation: the good, the bad, and the unknown, Forensic Sci. Int. Digit. Investig., 46
- Scanlon, 2023, Digital forensic investigation in the age of ChatGPT, Forensic Sci. Int.: Digit. Investig., 44
- Shang, 2025, Thumb: a forensic automation framework leveraging MLLMs and OCR on android device, Forensic Sci. Int.: Digit. Investig., 54
- Shao, 2024, Survey of different large language model architectures: trends, benchmarks, and challenges, vol. 12, 188664
- Sharma, 2025, ForensicLLM: a local large language model for digital forensics, Forensic Sci. Int. Digit. Investig., 52
- Wang, 2024, A survey on large language model based autonomous agents, Front. Comput. Sci., 18
- Wickramasekara, 2025, Exploring the potential of large language models for improving digital forensic investigation efficiency, Forensic Sci. Int. Digit. Investig., 52
Cited by
Sorted by citations
Xin, Q. (2026) · Aviation Electronics Information Technology Telecommunications Electricals Controls (AVITEC) · doi:10.28989/avitec.v8i2.3973 · Cited by 12 · see citing works
Raza, S., Ho, J., Raza, M., & Emmanouilidis, C. (2026) · ACM International Workshop on Multimedia AI against Disinformation (MAD) · doi:10.1145/3810988.3812659 · Cited by 1 · see citing works
Hameed, N. A. (2026) · International Journal of Intelligent Engineering and Systems · doi:10.22266/ijies2026.0831.27
Query-based digital forensic triage using vision language models and explainable AI
Philip, A. O., U., S. M., Raju, M., P., A. A., & Swathi, R. (2026) · Cluster Computing · doi:10.1007/s10586-026-06138-1
Vasylova, O. V. (2026) · Izdevniecība “Baltija Publishing” eBooks · doi:10.30525/978-9934-26-699-7-2
CRIMINAL JUSTICE: HANS GROSS’S VISION AND THE PRESENT DAY
Bodnaruk, O., Toma, M. H., VASYLOVA, O., Vynnyk, A., Volobuev, A. F., Dasiuk, V., Zharovska, H., Zinsu, O., Шуст, Г. П., Zinukhova, V. M., et al. (2026) · Izdevniecība “Baltija Publishing” eBooks · doi:10.30525/978-9934-26-699-7
Haenni, D., Ebert, L. C., Lux, C., & Dobler, E. (2026) · Research Square · doi:10.21203/rs.3.rs-11216853/v1
Pawlaszczyk, D., Labudde, D., Hummert, C., Bodach, R., Engler, P., Kolouch, J., & Spranger, M. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7559478
Tleu, R. (2026) · Journal of Intelligent Digital Systems · doi:10.52578/3135-0771-2026-3-23-32
- Authors
- Chernyshev, M., Baig, Z., Syed, N., Doss, R., & Shore, M.
- Affiliations
- Deakin University (AU)
- Corresponding author
- Chernyshev, Maxim
- Venue
- Forensic Science International: Digital Investigation
- Publisher
- Elsevier BV
- Published
- 2026-03
- Volume
- 56
- Pages
- 302043
- ISSN
- 2666-2817 (ISSN-L)
- OpenAlex
- W7118376563
- Semantic Scholar
- 19e817c8ae969a310f3aac3d7399b6383654cff6
- Cited by
- 10
- References
- 6
- Citations by year
- 2026: 10
- FWCI
- 45.44
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Forensic Science International Digital Investigation (publishedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Digital Media Forensic Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Authorship Attribution and Profiling
- Keywords
- large language models, digital forensics, generative AI, forensic evidence analysis, explainability, reproducibility, legal admissibility, validation framework, evaluation protocol, human-AI collaboration
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
