ForenSight

The problem

Digital-forensics tools can recover an overwhelming amount of data, but investigators still need to answer a human question: what happened, what supports that conclusion, and what remains uncertain?

I built ForenSight to make that reasoning process clearer. Instead of treating AI as an authority, ForenSight uses it as a constrained investigation assistant: deterministic code extracts and orders evidence, AI reasons over that structured evidence, and the application validates the citations before presenting a conclusion.

What it does

ForenSight accepts forensic artifacts and extracted evidence timelines, then:

• profiles the artifact locally and records integrity information such as SHA-256;
• reconstructs a chronological event timeline;
• connects relevant files, devices, users, and activity;
• uses OpenAI to generate an evidence-cited investigation summary;
• validates that every AI citation refers to a real local evidence ID;
• provides Challenge Mode, which looks for alternative explanations, missing artifacts, and weak assumptions;
• supports a local-only CTF Hunt workflow for flag-shaped strings such as picoCTF{...};
• enables safe inspection of recovered file copies without executing evidence.

The raw disk image is not sent to OpenAI. The model receives only selected, normalized event records, and web/tool access is disabled during forensic reasoning.

What inspired it

The inspiration came from a simple concern: AI-generated forensic conclusions can sound extremely confident even when the evidence is incomplete. In an investigation, an unsupported claim is worse than an uncertain answer.

ForenSight is designed around a different principle:

Code calculates. AI reasons. Code verifies.

The goal is not to replace established forensic tools. It is to make their output easier to investigate, explain, challenge, and demonstrate—especially for students, CTF players, and early-stage analysts.

How I built it

The frontend is built with React, TypeScript, and Vite, with a focused investigator interface that reveals information progressively: upload evidence, profile it locally, review the timeline, inspect specific files, and then challenge the conclusion.

A Python/FastAPI backend performs local artifact processing. It normalizes extracted findings into evidence records with timestamps, event types, sources, and stable evidence IDs. It also computes hashes and supports local recovery/inspection workflows.

For reasoning, ForenSight uses the OpenAI Responses API with structured JSON output. The backend asks the model for hypotheses, confidence, supporting evidence, uncertainty, and alternative explanations. Before any result reaches the interface, ForenSight checks that every cited evidence ID actually exists in the case.

I tested the workflow with CTF disk-image material and public forensic datasets such as NIST CFReDS data-leakage evidence.

Challenges I faced

The hardest part was not calling an AI model—it was ensuring that the system did not become a convincing storyteller.

Key challenges included:

• handling different artifact types and incomplete metadata;
• making large disk-image workflows usable locally;
• distinguishing direct evidence from inference;
• preventing fabricated or invalid evidence citations;
• designing Challenge Mode so it genuinely weakens unsupported claims instead of producing generic disclaimers;
• keeping the UI understandable for someone who is not already a forensic analyst.

What I learned

I learned that trustworthy AI systems need clear boundaries. Structured outputs are useful, but they are not enough by themselves; the application must validate citations, preserve provenance, and show uncertainty explicitly.

I also learned that the most compelling forensic feature is not a higher confidence score. It is the ability to say:

“Here is the evidence, here is what it supports, and here is why the conclusion could still be wrong.”

What’s next

Next steps include deeper artifact parsers, richer cross-device evidence graphs, exportable investigation reports, stronger CTF file-carving workflows, and more evaluation against documented forensic ground truth.

Built With

• css
• ctf
• digital-forensics
• fastapi
• nist-cfreds
• openai-api
• openai-responses-api
• pydantic
• pyewf
• python
• pytsk3
• react
• sha-256
• structured-outputs
• the-sleuth-kit
• typescript
• vite