Artificial Intelligence (AI) in Forensic Sciences

Edited by Zeno Geradts, is a senior forensic scientist at the Forensic Digital Biometrics Traces Department at the Netherlands Forensic Institute, Ministry of Justice and Security, The Hague, The Netherlands. Katrin Franke is Professor of Computer Science at the Department of Information Security and Communication Technology at NTNU in Gjøvik, Norway. She has over 25 years’ experience in basic and applied research for financial services and law enforcement agencies (LEAs), working closely with banks and LEAs in Europe, North America and Asia.

• About the editors, ixList of Contributors, xSeries Preface, xiPreface Book, xiiAcknowledgements, xiii1 Introduction, 1Zeno Geradts and Katrin Franke2 AI-based Forensic Evaluation in Court: The Desirability of Explanation and the Necessity of Validation, 3Rolf J.F. Ypma, Daniel Ramos, and Didier Meuwly2.1 Introduction, 32.1.1 AI for Forensic Evaluation, 62.2 The Desirability for Explanation and the Necessity of Validation, 72.3 Explainability (and its Validity), 82.3.1 Reasons to Pursue Explanations, 92.3.2 Types of Explanations, 92.3.3 Limitations of Explanations, 112.4 Validation (and its Explanation), 112.4.1 Measure the Method's Performance, 122.4.2 Approach in Four Steps, 122.4.3 Accountability, 162.5 Conclusion, 173 Machine Learning for Evidence in Criminal Proceedings: Techno-legal Challenges for Reliability Assurance, 21Radina Stoykova, Jeanne Mifsud Bonnici, and Katrin Franke3.1 Introduction: AI in the Intersection of Criminal Procedure and Forensics, 213.1.1 Technical Fragmentation in Digital Investigations, 213.1.2 Legal and Methodological Fragmentation in Digital Investigations, 223.1.3 Specifics of ML-based Investigative Approach, 233.1.4 Scope and Definitions, 253.2 Legal Framework, 273.2.1 The Fair Trial Principle, 283.2.2 Necessity and Proportionality of Investigative Measures, 323.2.3 The AIA Proposal, 333.2.4 AI System Development and Legislative Contradictions, 353.3 Machine Learning Pipelines: Techno-legal Challenges, 443.3.1 Task + Purpose Limitation and Data Minimization, 443.3.2 Dataset Engineering and Data Governance, 483.3.3 Pre-processing for Input: Trade-offs between Accuracy and Computational Costs, 533.3.4 Modelling, 563.4 AI Use in Investigations: AI System Design + Data Protection = Fair Trial?, 633.5 Conclusion, 664 Formalising Representation and Interpretation of Digital Evidence to Reinforce Reasoning and Automated Analysis, 74Eoghan Casey and Timothy Bollé4.1 Introduction, 744.2 Background and Related Work, 764.3 Method, 774.4 Representing Digital Traces, 794.5 Representing Computed Similarity, 864.6 Representing ML Classification, 894.7 Representing Hypothesis Test Results (a.k.a. Inferences), 914.7.1 Location Example, 934.7.2 Identification Example, 954.8 Effective/Reliable/Responsible Automated Analysis, 994.9 Conclusion, 1015 Servicing Digital Investigations with Artificial Intelligence, 103Harm van Beek and Hans Henseler5.1 Introduction, 1035.2 Introduction To Hansken, 1045.2.1 Normalized Trace Model, 1055.2.2 Forensic Tool Application, 1065.2.3 Hansken's Application Programming Interfaces, 1085.3 Large Scale Application of AI Techniques, 1095.3.1 Rule-based AI Techniques Implemented in Hansken, 1095.3.2 Deep-learning AI Techniques Currently Implemented in Hansken, 1115.3.3 Deep-learning AI Techniques to be Implemented in Hansken, 1155.3.4 The application of large language models in digital forensics, 1185.4 Conclusions and Further Reading, 1206 On the Feasibility of Social Network Analysis Methods for Investigating Large-scale Criminal Networks, 123Jan William Johnsen and Katrin Franke6.1 Introduction, 1236.2 Previous Work, 1256.3 Material and Methods, 1276.3.1 Real-world Underground Forum Database Dumps, 1276.3.2 Network Centrality Measures, 1296.3.3 Measuring Association Using Bi-variate Analysis, 1296.3.4 Topic Modelling Algorithms, 1306.4 Experimental Setup, 1306.4.1 Evaluating Network Centrality Measures for Forensics, 1306.4.2 Our Novel Approach for Analysing Cybercriminal's Technical Skills, 1336.5 Experimental Results and Discussion, 1376.5.1 Correlation Testing, 1376.5.2 Our Newly Proposed Method, 1426.6 Conclusion, 1457 Mapping NLP Techniques to Investigations and Investigative Interviews, 149Kyle Porter and Bente Skattør7.1 Introduction, 1497.2 Criminal Investigation, 1507.2.1 Investigative Interviews, 1507.3 Assessing the Needs of Investigators in an NLP Context, 1517.3.1 Mapping Interviewer Needs to Existing NLP Tasks, 1517.4 Automatic Speech Recognition, 1527.4.1 ASR Basics, 1527.4.2 ASR, Digital Investigation, and the State of the Art, 1537.5 NLP Basics, 1547.5.1 Common Terminology, 1547.5.2 Vector Space Models and Embeddings, 1567.5.3 Modern NLP Models, 1577.6 Text Extraction, 1577.6.1 Entity Identification and Named Entity Recognition, 1577.6.2 Named Entity Recognition Metrics, 1587.6.3 NER Applied to Investigations, 1597.6.4 Entity Linking, 1597.6.5 Limitations of Using NER, 1607.6.6 Extraction Methods outside NER, 1617.7 Text Classification, 1617.7.1 Classification Evaluation Metrics, 1627.7.2 Text Classification and Digital Investigation, 1627.7.3 Classification Limitations, 1637.8 Text Reduction, 1647.8.1 Thematic Extraction and Topic Modelling, 1647.8.2 Topic Modelling and Digital Investigations, 1657.8.3 Limitations of Topic Modelling, 1667.8.4 Text Summarization, 1667.8.5 Text Summarization and Digital Investigations, 1677.8.6 Summarization Limitations, 1677.9 Discussion and Conclusion, 1677.9.1 Future Work, 1698 The Influence of Compression on the Detection of Deepfake Videos, 174Meike Kombrink and Zeno Geradts8.1 Introduction, 1748.2 Method, 1788.2.1 Dataset, 1788.2.2 Deepfake Detection, 1808.3 Results, 1838.3.1 Compressed Dataset, 1838.3.2 Algorithms, 1848.4 Discussion, 1908.4.1 Deepfake Detection, 1908.4.2 Compression, 1918.4.3 Future Work, 1938.5 Conclusion, 1939 Event Log Analysis and Correlation: A Digital Forensic Perspective, 195Neminath Hubballi and Pratibha Khandait9.1 Introduction, 1959.2 Sources of Logs, 1979.2.1 End Host System Logs, 1989.2.2 Networking Devices and Security Applications, 2039.2.3 Application Logs, 2079.3 Need for Correlation, 2089.4 Correlation Techniques, 2109.5 Conclusions, 21410 (Hyper-)graph Analysis and its Application in Forensics, 216Marcel Worring10.1 Introduction, 21610.2 Survey of Methods, 21810.2.1 Preliminaries, 21810.2.2 Tasks, 21910.2.3 Graph Neural Networks, 22010.3 Explainability and Visualization, 22410.4 Conclusion, 22711 Conclusion, 230Zeno Geradts and Katrin FrankeIndex, 232