Autonomous Digital Forensic Investigation Platform(ADFIP)

Inspiration

Digital forensic investigations often require investigators to manually examine large amounts of evidence from disks, memory dumps, network captures, and suspicious files. This process can be time-consuming and requires expertise across multiple forensic tools.

We were inspired to build ADFIP (Autonomous Digital Forensic Investigation Platform) to explore how multi-agent AI can assist investigators by coordinating specialized forensic analysis tasks. Instead of replacing forensic tools, ADFIP connects them through an intelligent workflow so that evidence can be analyzed, correlated, verified, and presented in a structured investigation.

Our goal is to make complex forensic investigations more efficient while preserving evidence integrity, auditability, and investigator oversight.

What it does

ADFIP provides an AI-assisted workflow for digital forensic investigations.

The platform allows an investigator to:

Create and manage forensic investigation cases.
Import and preserve digital evidence.
Calculate and verify SHA-256 evidence hashes.
Maintain evidence and audit records.
Assign analysis tasks to specialized AI agents.
Analyze disk evidence using The Sleuth Kit and Autopsy.
Analyze memory dumps using Volatility 3.
Analyze network traffic using Wireshark/tshark.
Perform suspicious-file and malware analysis.
Correlate findings from multiple evidence sources.
Reconstruct an investigation timeline.
Distinguish evidence-supported facts from AI-generated inferences.
Review findings before final reporting.
Generate structured forensic investigation reports.

The multi-agent workflow enables different agents to specialize in disk, memory, network, malware, correlation, timeline reconstruction, verification, and reporting tasks.

How we built it

ADFIP is built using Python as the core development language.

The planned architecture uses LangGraph for multi-agent orchestration and Ollama for locally hosted LLM inference. PostgreSQL is used for structured investigation data, evidence metadata, findings, and audit information.

The forensic analysis layer integrates established digital forensic tools:

The Sleuth Kit for disk and file-system analysis
Autopsy for forensic examination
Volatility 3 for memory analysis
Wireshark/tshark for network analysis
SHA-256 for evidence integrity verification

The investigation workflow follows:

Evidence Acquisition → Evidence Preservation → AI Task Assignment → Specialized Forensic Analysis → Finding Correlation → Timeline Reconstruction → Verification → Investigator Review → Report Generation.

A key design principle is that the AI does not directly replace forensic evidence collection or analysis tools. Instead, AI acts as an orchestration and reasoning layer over established forensic tooling.

Challenges we ran into

One of the biggest challenges was designing an AI workflow that remains reliable for forensic investigations. An LLM can generate plausible but unsupported conclusions, so we needed to ensure that AI-generated findings remain connected to actual forensic evidence.

We also faced challenges in integrating different forensic tools because each tool produces different types and formats of output.

Maintaining evidence integrity was another important challenge. The platform needs to ensure that evidence is preserved and that any modification or transfer can be detected through cryptographic hashing and audit records.

Another challenge was designing the system so that investigators remain in control. Instead of allowing the AI to make unsupported final conclusions, ADFIP uses verification and investigator-review stages before reporting.

Accomplishments that we're proud of

We are proud of designing an end-to-end multi-agent architecture specifically for digital forensic investigation rather than using AI as a simple chatbot.

Our key accomplishments include:

Designing specialized forensic agents for different evidence types.
Integrating established forensic tools into an AI-assisted workflow.
Implementing evidence integrity verification using SHA-256.
Designing evidence custody and audit tracking.
Creating a workflow for correlating disk, memory, network, and malware findings.
Designing automated forensic timeline reconstruction.
Introducing a FACT vs. INFERENCE distinction to reduce unsupported AI conclusions.
Building an investigator review stage before report generation.
Creating a foundation for automated forensic report generation.

These components together form the foundation of an extensible AI-assisted forensic investigation platform.

What we learned

We learned that applying AI to digital forensics requires much more than connecting an LLM to forensic data.

Evidence integrity, provenance, reproducibility, tool reliability, auditability, and human verification are equally important.

We also learned how different forensic domains complement each other. A suspicious file found during disk analysis becomes much more meaningful when it can be correlated with a process discovered in memory and network activity observed in a packet capture.

Most importantly, we learned that AI should assist investigators by organizing and correlating evidence, while conclusions must remain traceable to the underlying forensic artifacts.

What's next for Autonomous Digital Forensic Investigation Platform (ADFIP)

Our next goal is to move ADFIP from a prototype toward a more complete cross-platform forensic investigation product.

Future improvements include:

Expanding real forensic-tool integrations.
Improving autonomous task planning between agents.
Adding more disk, memory, network, and malware analysis capabilities.
Developing stronger cross-source evidence correlation.
Improving timeline reconstruction.
Adding advanced investigator dashboards and visualizations.
Strengthening role-based access control and audit logging.
Supporting larger forensic datasets.
Containerizing forensic analysis components using Docker.
Improving PostgreSQL-based production deployment.
Adding more automated verification mechanisms.
Evaluating the system against controlled forensic datasets.
Measuring investigation time, correlation accuracy, false positives, and report-generation performance.
Exploring commercialization and potential intellectual-property opportunities.
Preparing research findings for academic publication.