Forensic Intelligence Graphs: An LLM Approach to Digital Evidence Extraction and Relationship Analysis

Digital forensics often requires deriving meaningful and investigative intelligence from vast amounts of evidence scattered across various artifacts. In this study, we propose an automated approach to gain insights about criminal incidents using digital evidence networks constructed with the aid of Large Language Models (LLMs). Our method utilizes LLMs to extract evidence entities from mobile devices and infers relationships among them. Using this information, the model enables the generation of Forensic Intelligence Graphs (FIGs). These graphs visually represent evidence entities and their interrelations, providing an intelligence-driven approach to forensic data analysis. Using evidence extracted from Android mobile devices, an empirical evaluation demonstrates that the LLM-aided FIG achieves 93.33% coverage of evidence entities and 86.96% coverage of evidence relationships, effectively uncovering all relevant suspect scenarios. Moreover, our approach uncovered 27 additional evidence entities and 83 relationships beyond those recorded in the official documentation, highlighting its ability to reveal previously overlooked forensic artifacts.