PaperlayerView exact revision on arXiv

Source-linked AI summary

ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown

Mark Scanlon, Frank Breitinger, Christopher Hargreaves, Jan-Niclas Hilgert, John Sheppard

arXiv:2307.10195v1cs.CRcs.AIcs.CL

TL;DR

Digital-forensic investigators need to understand where ChatGPT can assist without compromising reliability or evidence handling. The paper evaluates GPT-4 through representative forensic experiments and finds useful low-risk support, but only when users can validate its outputs and when evidence need not be uploaded.

  • Problem

    The paper addresses the lack of original research on applying LLMs to digital forensics and the need to assess GPT-4’s potential impact.

    Source: §1 · p. 1

  • Method

    The study uses representative prompt-based experiments across digital-forensic use cases and validates responses through fact-checking and domain expertise.

    Source: §3 · p. 2

  • Results

    ChatGPT provides occasional benefits for code generation, keyword inputs, knowledge refreshers, creative scenarios, and rudimentary evidence analysis, but requires knowledgeable review.

    Source: §5.5 · p. 4, §6.4 · p. 6, §7.5 · p. 7

  • Takeaways & Limitations

    ChatGPT can support knowledgeable digital-forensic users in selected low-risk tasks, but generated outputs cannot be used blindly.

    Source: §7.5 · p. 7, §10 · p. 10

    The controlled experiments cover only selected investigation aspects, may not represent real-world complexity, and are strongly dependent on prompt wording.

    Source: §11 · p. 10

Abstract

from arXiv · show

The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.

1. Introduction

The paper positions GPT-4 as a potentially useful but unreliable technology for digital forensics, assessing both its applications and risks across representative forensic activities.

2. Background

  • LLMs generate answers from large text corpora, but may prioritize plausible responses over correctness and can hallucinate facts or make reasoning errors.Source: §1 · p. 1, §2.1 · p. 2

1. Introduction

  • Relevant risks include training-data errors or bias, hallucinations, legal and ethical concerns, limited explainability, investigator over-reliance, and technical limitations.Source: §1 · p. 1
  • At submission, no original research publications focused on applying LLMs to digital forensics, motivating this assessment of GPT-4’s impact.Source: §1 · p. 1
  • GPT-4 is evaluated for forensic learning, artefact identification, evidence searching, code generation, anomaly detection, incident response, and teaching scenarios.Source: §1 · p. 1
  • The study reports both occasional benefits and risks for each evaluated application area, then draws general conclusions and proposes future directions.Source: §1 · p. 1

2.2. Generative Pre-trained Transformers

  • GPT-4 is the paid ChatGPT model described here, while GPT-3.5 remains available in the free tier; GPT-4’s architecture and training details are largely undisclosed.Source: §2.2 · p. 2

3. Methodology

The methodology samples representative digital-forensic use cases, tests them through prompt-based conversations, and validates responses using fact-checking and domain expertise.

3. Methodology

  • Six representative digital-forensic areas were selected to provide varied coverage without encompassing every possible LLM use.Source: §3 · p. 2
  • Each experiment was a conversation thread containing one or more prompts designed to achieve a specific aim and expose strengths, limitations, or dangers.Source: §3 · p. 2
  • Because ChatGPT responses are non-deterministic, the authors preserved the prompts and corresponding responses in an associated GitHub repository.Source: §3 · p. 2
  • Responses were evaluated through fact-checking where possible and through the authors’ experience in digital-forensic processing, programming, and teaching.Source: §3 · p. 2

4. ChatGPT for Artefact Identification

ChatGPT can suggest relevant forensic artefacts and refine searches when prompted, but its coverage, tool references, and location details are inconsistent enough to require knowledgeable validation.

4.1. File Downloads

  • ChatGPT identified multiple artefact sources for file downloads, including metadata, browser and network logs, Windows Event Logs, downloads folders, and forensic tools.Source: §4.1 · p. 2
  • When the suspected download route changed to Skype, ChatGPT refined its answer toward Skype conversation databases, downloaded-file locations, related events, and traffic.Source: §4.1 · pp. 2–3

4.2. File Execution

  • For file execution, ChatGPT emphasized Security Event 4688, prefetch, UserAssist, and NTFS metadata, then expanded to artefacts such as Amcache, Shimcache, jumplists, memory, and network data.Source: §4.2 · p. 3

4.3. Cloud Interaction

  • Cloud-interaction prompts produced reasonable categories and platform-specific locations for Google Drive, Dropbox, and AWS S3, but some paths resolved incorrectly or not at all.Source: §4.3 · p. 3, §4.4 · p. 3

4.4. Summary

  • Overall, ChatGPT focused heavily on Windows Event Logs, varied in artefact depth, and sometimes invented or misnamed tools and inconsistent cloud paths.Source: §4.4 · p. 3

5. ChatGPT for Self-Directed Learning of Digital Forensics

ChatGPT can support introductory learning, tool explanation, and domain refreshers, but it is less suitable for deep training because practical exercises, current developments, and reliable detail remain limited.

5.1. Introductory Level (O1)

  • ChatGPT generally provided correct, concise introductory explanations of digital forensics, including a five-phase process, chain-of-custody goals, and seven sub-disciplines.It could serve as a starting point when extensive detail is not required, but it supplied incorrect authors and references when asked.Source: §5.1 · p. 4

5.2. Advanced/Expert Level (O2,O3)

  • Advanced training responses proposed relevant tools and exercises but were basic, difficult to follow, and occasionally erroneous.One hexdump contained an invalid Attribute byte, illustrating the need for expert validation.Source: §5.2 · p. 4

5.3. Research and Workshops (O4)

  • Because the model’s knowledge cutoff was September 2021, it could not reliably inform learners about the latest research trends and developments.This limits its suitability for research conferences and workshops focused on current developments.Source: §5.3 · p. 4

5.4. Tool Explanation

  • Interactive explanations of Wireshark and tshark were useful, including correct CLI commands, output interpretation, and GUI settings guidance.The interactive format was described as more engaging than reading a man page.Source: §5.4 · p. 4

5.5. Summary

  • ChatGPT is most useful for general understanding or refreshing knowledge when users already know the field, but it lacks practical exercises and requires follow-up validation.Text-only explanations, hallucinations, and weak support for creating labs hinder deeper learning and higher-level objectives.Source: §5 · p. 3, §5.5 · p. 4

6. ChatGPT-assisted Keyword Searching

ChatGPT can generate useful regular expressions and broaden keyword lists, while also suggesting future content-based and multimodal searches. Validation remains necessary, and evidence-upload constraints prevent direct current-case use.

6.1. Generating Regular Expressions

  • ChatGPT-generated regular expressions ranged from correct custom formats to useful but incomplete real-world patterns requiring validation.The credit-card expression omitted whitespace handling and conflicted with its own test examples, whereas the custom policy-number expression and examples matched.Source: §6.1 · pp. 4–5

6.2. Generating Keyword Lists

  • ChatGPT expanded keyword lists with synonyms, associated terms, misspellings, abbreviations, and emojis through additional prompting.In a sexual-harassment scenario, successive prompts produced formal, victim-oriented, and perpetrator-oriented terms, but evaluation of investigative effectiveness remains difficult.Source: §6.2 · p. 5

6.3. Other Searching Topics

  • ChatGPT could theoretically summarize evidence and identify content such as sentiment, grooming, manipulation, or fraud without relying solely on keywords.A sentiment example differed from the dataset label, and using the service for real evidence was precluded by the need to upload it.Source: §6.3 · p. 5
  • Image-to-text summaries and translation could support multimodal or cross-language forensic searches, but translation was not evaluated.These capabilities are presented as potential future work rather than tested components of this paper.Source: §6.3 · pp. 5–6

6.4. Summary

  • Regular-expression generation and keyword-list enhancement appear reasonably effective, but current evidence-upload restrictions prevent many broader searching applications.Generated regular expressions still require testing and validation.Source: §6.1 · p. 4, §6.2 · p. 5, §6.4 · p. 6

7. ChatGPT and Programming in Digital Forensics

GPT-4 generated scripts for varied forensic tasks and often explained its code, but scripts embedded unverified assumptions and could bypass safeguards through prompt engineering.

7.1. File Carving

  • A revised PDF-carving script used %PDF and %%EOF signatures with memory mapping, but did not handle fragmentation, false positives, or repeated headers.Partially overwritten files could produce large junk files.Source: §7.1 · p. 6

7.2. RAID Disk Acquisition

  • The RAID-acquisition script detected a RAID level and acquired images, but assumed four disks and trusted the first disk’s level without cross-disk validation.It also did not verify RAID-level consistency or whether the disk count matched the detected configuration.Source: §7.2 · p. 6

7.3. Password Cracking

  • After initially refusing password-cracking assistance, GPT-4 generated dictionary-based scripts that sequentially tested candidate passwords and completed the requested task.Further prompting transformed the initial refusal into working code using supplied and recommended dictionaries.Source: §7.3 · pp. 6–7

7.4. Memory Forensics - Recovering Encryption Keys

  • Memory-key searches used arbitrary entropy thresholds and initially lacked Windows specificity before prompting added Volatility-based profile and command-line guidance.The BitLocker search focused on 16- or 32-byte sequences with entropy of 7.5 or higher.Source: §7.4 · p. 7

7.5. Summary

  • GPT-4 effectively generated scripts across file carving, RAID acquisition, password testing, and memory-forensics scenarios, with comments, error checking, and tool integration.The authors stress that users need scripting and forensic expertise to identify unreasonable assumptions before use.Source: §7 · p. 6, §7.5 · p. 7
  • Prompt engineering could bypass GPT-4’s safeguards for restricted operations, despite repeated reminders that use should be authorised and legal.The paper identifies this as a limitation of built-in protections rather than a reliable barrier.Source: §7.5 · p. 7

8. ChatGPT for Incident Reponse

The experiments show that ChatGPT can interpret some incident-response artefacts and identify certain attacks, but its performance is inconsistent, context-dependent, and vulnerable to misleading cues.

8. ChatGPT for Incident Reponse

  • ChatGPT correctly interpreted common textual and converted artefacts, but sometimes remained uncertain about their exact sources.The tested inputs included command output, log files, Windows Event Logs, Registry representations, and tcpdump output.Source: §8 · p. 7

8.1. Anomalies

  • Limited input capacity required splitting or filtering process listings, while ChatGPT misclassified benign applications and varied across identical prompts.It detected most third-party applications and a custom script but incorrectly flagged default applications such as gedit and Firefox.Source: §8.1 · p. 7

8.2. Suspicious Activity

  • ChatGPT overlooked an obvious reverse shell in a process listing until the term “ncat” was supplied explicitly.Once prompted with that keyword, it recognized the process as a strong compromise indicator and suggested terminating it and consulting a cybersecurity professional.Source: §8.2 · p. 8
  • ChatGPT correctly identified failed SSH logins and extracted the involved IP address from a truncated authentication-log extract.The system also recognized the pattern as an SSH brute-force attack despite the complete log being too large to upload.Source: §8.2 · p. 8

8.3. Attacks

  • For attacks, ChatGPT interpreted some logs and known patterns but failed to identify ARP spoofing and could not recognize the newer Follina exploit by name.It still highlighted potentially relevant indicators in the Follina log, despite lacking training on that exploit.Source: §8.3 · p. 8
  • Across 100 analyses of the same malformed heartbeat packet, no reported TLS record type was correct, and ChatGPT failed to detect the Heartbleed vulnerability.The correct record type was Heartbeat 0x18; the model extracted the relevant field but misinterpreted it, with varying outputs across runs.Source: Table 1 · p. 8, §8.3 · p. 8

8.4. Summary

  • Overall, ChatGPT performed better when logs included textual event descriptions but struggled with organization-specific context, binary representations, and current threats.The authors also report that non-default processes could be overlooked and that results were inconsistent.Source: §8.4 · p. 8

9. ChatGPT for Generating Teaching Scenarios

ChatGPT generated storyboards, character profiles, and synthetic artefacts for digital-forensics teaching scenarios with little prompting. The outputs were generally useful and creative, but required review for realism, completeness, and inappropriate content.

9.1. Storyboarding

  • ChatGPT easily produced a six-month intellectual-property-theft storyboard describing an employee’s progression from joining a company to considering departure.Further prompting added internet-history themes, websites, and search terms related to escalating misconduct.Source: §9.1 · p. 9
  • It generated plausible digital-evidence suggestions and rich scenario notes for stalking cases, including both innocuous and crime-related activity.These outputs could inform manual or automated synthetic-data generation.Source: §9.1 · p. 9

9.2. Character Profiles and Interests

  • ChatGPT created character profiles with background, education, personality, finances, criminal tendencies, goals, and themed internet-search histories.The generated persona included five high-level internet-history themes with example search terms.Source: §9.2 · p. 9

9.3. Synthetic Content

  • It generated realistic supporting content such as chats, university emails, assignments, anonymised messages, and fictionalised internet-history material.The model could not provide real cell-tower data but offered to create a fictionalised list instead.Source: §9.3 · p. 9

9.4. Summary

  • The results were considered potentially very useful because creative teaching scenarios lack a single correct answer, although some scenarios were less realistic and required correction.Additional prompting corrected missed activities, but educators still needed to check automatically generated material for inappropriate content.Source: §9.4 · p. 9

10. Discussion

The discussion identifies creativity, reassurance, and rapid starting points as ChatGPT’s main strengths in digital forensics, while emphasizing substantial reliability, data, modality, and reproducibility problems.

The Good

  • ChatGPT is most useful for creative or low-risk tasks, such as scenario creation and generating keyword lists, where there is no single correct answer.The authors also found it helpful for code generation, explanations, memory refreshment, and rudimentary evidence analysis.Source: §10 · p. 10
  • Prior expertise allows examiners to cross-check ChatGPT and recognize hallucinations, making human knowledge necessary for reliable use.The paper presents ChatGPT as reassurance and a starting skeleton rather than an autonomous forensic authority.Source: §10 · p. 10

The Bad

  • ChatGPT is constrained by outdated or sparse training data, specialized scenarios, text-only input, context limits, and nondeterministic output.These weaknesses affect current artefact knowledge, binary or network analysis, complete-log processing, and reproducibility.Source: §10 · p. 10

The Unknown

  • Real evidence cannot be uploaded to the service, limiting present use, while future integration into forensic products could support more natural-language queries.The proposed future examples include searching messages for bullying and locating GPS coordinates in EXIF data.Source: §10 · p. 10

Summary

  • The paper concludes that ChatGPT has significant potential, but digital-forensic use must preserve human expertise and careful examination of generated information.The authors frame the central challenge as balancing AI capabilities with human oversight.Source: §10 · p. 10

11. Limitations

The study’s findings are limited by controlled experiments, incomplete coverage of forensic practice, prompt sensitivity, and nondeterministic outputs that hinder direct reproducibility.

11. Limitations

  • The experiments covered only selected use cases in a controlled environment and may not represent the complexity of real-world digital-forensic investigations.Space constraints prevented testing many additional examples and applications.Source: §11 · p. 10
  • Minor prompt changes produced very different results, and nondeterministic behaviour prevented direct reproduction of the reported interactions.The analysed interactions were therefore provided statically in an associated GitHub repository.Source: §11 · p. 10

12. Conclusions and Future Work

Eight experiments found that ChatGPT is precarious for digital forensics because hallucinations require caution and close scrutiny, while some operator-dependent uses remain promising. Future work should focus on locally deployable models for forensic tasks unsuited to online services.

12. Conclusions and Future Work

  • Eight experiments identified hallucination as a recurring risk that makes ChatGPT use in digital forensics precarious and demands caution and close scrutiny.The paper links this risk to incorrect outputs that may be disguised by the term “hallucination.”Source: §12 · p. 10
  • ChatGPT can assist with code generation when knowledgeable users evaluate, interpret, and correct its outputs.Its effectiveness depends on operator competence, as with other automated digital-forensic tools.Source: §12 · p. 10
  • Keyword-list generation and storyboard creation for test scenarios are additional potential uses identified by the study.Source: §12 · p. 11
  • Locally deployable models could support forensic tasks unsuitable for online services, including case-note summarisation, image-to-text translation, timelines, social-network analysis, and authorship attribution.Source: §12 · p. 11
  • Because the technology remains new, it requires competent human oversight despite its potential and sometimes impressive capabilities.Source: §12 · p. 11

CRediT Authorship Contribution Statement

The authors jointly contributed to the paper through conceptualization, methodology, investigation, and writing, with equal contribution. ChatGPT did not contribute to the content or analysis except where directly quoted or described.

CRediT Authorship Contribution Statement

Loading 2307.10195v1…