Digital evidence is typically extracted and preserved using specialized forensic tools. However, advancements in technology have contributed to the development of messaging platforms such as Signal and Telegram for which existing forensic tools often fall short. Developing new forensic tools is time-consuming and resource intensive. This chapter addresses the challenges by employing quick-fix digital evidence collection methods that leverage built-in functions provided by instant messaging platforms. To enhance the digital forensic examination workflow, analytical tasks are offloaded to large language models using application programming interfaces provided by a large language model platform. The use of large language models significantly improves the efficiency of digital evidence processing. A triage screening methodology that provides executive summary reports is described. The methodology enhances the overall digital evidence collection workflow, ensuring that critical evidence and insights are not overlooked while maintaining rigorous standards of admissibility.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Enhancing Digital Evidence Collection and Analysis Using Built-In Instant Messaging Solutions and Large Language Models

  • Yi-Anson Lam,
  • Kam-Pui Chow,
  • Siu-Ming Yiu

摘要

Digital evidence is typically extracted and preserved using specialized forensic tools. However, advancements in technology have contributed to the development of messaging platforms such as Signal and Telegram for which existing forensic tools often fall short. Developing new forensic tools is time-consuming and resource intensive. This chapter addresses the challenges by employing quick-fix digital evidence collection methods that leverage built-in functions provided by instant messaging platforms. To enhance the digital forensic examination workflow, analytical tasks are offloaded to large language models using application programming interfaces provided by a large language model platform. The use of large language models significantly improves the efficiency of digital evidence processing. A triage screening methodology that provides executive summary reports is described. The methodology enhances the overall digital evidence collection workflow, ensuring that critical evidence and insights are not overlooked while maintaining rigorous standards of admissibility.