Enhancing Digital Evidence Collection and Analysis Using Built-In Instant Messaging Solutions and Large Language Models
摘要
Digital evidence is typically extracted and preserved using specialized forensic tools. However, advancements in technology have contributed to the development of messaging platforms such as Signal and Telegram for which existing forensic tools often fall short. Developing new forensic tools is time-consuming and resource intensive. This chapter addresses the challenges by employing quick-fix digital evidence collection methods that leverage built-in functions provided by instant messaging platforms. To enhance the digital forensic examination workflow, analytical tasks are offloaded to large language models using application programming interfaces provided by a large language model platform. The use of large language models significantly improves the efficiency of digital evidence processing. A triage screening methodology that provides executive summary reports is described. The methodology enhances the overall digital evidence collection workflow, ensuring that critical evidence and insights are not overlooked while maintaining rigorous standards of admissibility.