Inspiration

As digital investigations grow exponentially, investigators are flooded with thousands of heterogeneous artifacts—from browser history, network logs, and emails to volatile memory and removable USB media. The traditional workflow forces analysts to manually switch between tools, correlate scattered timestamps, and piece together relationships. This manual overhead wastes precious time and increases the risk of missing vital connections. We were inspired to build NyayaForensics AI to solve this bottleneck: shifting the paradigm from manual data crunching to evidence-grounded, explainable AI collaboration that preserves cryptographic integrity while supercharging incident reconstruction.

What it does

NyayaForensics AI is an AI-powered digital forensics and evidence intelligence framework that automates the ingestion, normalization, and correlation of digital artifacts. Key features include:

Cryptographic Provenance: Generates and verifies SHA-256 fingerprints for every piece of evidence to guarantee uncompromised integrity.
Neo4j Evidence Graphs & Timelines: Connects fragmented events into a structured graph database (users, devices, files, IPs, USBs) and maps out a chronologically coherent incident sequence.
Hybrid Anomaly Detection: Combines rule-based behavioral checks and ML-driven isolation models to flag suspicious patterns (like a USB connection followed by file access, archiving, and external upload).
Evidence-Grounded Copilot: An intelligent RAG-powered assistant that answers complex investigative queries while strictly citing the underlying evidence IDs and source files, explicitly keeping a boundary between observed facts and AI inferences.

How we built it

We architected a robust, modular full-stack framework utilizing industry-standard and high-performance technologies:

Backend & API: Built using Python 3.11+ and FastAPI for asynchronous, high-throughput artifact parsing and processing.
Databases & Storage: Leveraged PostgreSQL for relational metadata and case tracking, and Neo4j for mapping deep multi-hop evidence relationships.
AI & ML Layer: Integrated scikit-learn for anomaly detection, Transformers / spaCy & Sentence Transformers for NLP and entity/intent extraction, alongside an evidence-grounded LLM retrieval architecture.
Forensic Integrations & Frontend: Designed a responsive React + TypeScript investigator dashboard communicating with backend extraction pipelines powered by tools like ExifTool and YARA. Containerized the entire ecosystem seamlessly using Docker & Docker Compose.

Challenges we ran into

Maintaining Strict Provenance vs. AI Hallucination: Ensuring that the generative AI copilot never "hallucinated" facts or silently altered conflicting logs was a massive architectural hurdle. We solved this by enforcing a rigorous separation layer between Observed, Correlated, Inferred, and Verified evidence, tying every single AI output back to a cryptographic SHA-256 hash.
Complex Multi-Artifact Correlation: Harmonizing scattered timestamps across completely different system logs, network traces, and filesystem metadata into a singular, unambiguous timeline required building a custom correlation scoring function ($Correlation(e_i,e_j)$).

Accomplishments that we're proud of

Successfully engineering a fully transparent, evidence-grounded Copilot that doesn't just output generic text, but directly maps every claim back to specific evidence IDs and audit logs.
Building a lightning-fast dual-database backend (PostgreSQL + Neo4j) that bridges relational data integrity with graph-based threat intelligence.
Developing a clean, comprehensive end-to-end synthetic case dataset and pipeline that simulates a complete insider-threat data exfiltration scenario from raw file access to external upload.

What we learned

AI is an Assistant, Not a Judge: True forensic AI cannot replace human verification; its ultimate power lies in accelerating triage while leaving the final chain of custody and legal validation strictly anchored to deterministic cryptographic proofs.
Graph Intelligence is Essential for Forensics: Relational databases alone are insufficient for modern threat hunting—visualizing how a user, device, file, USB, and external IP domain interact via a graph database drastically reduces investigation cognitive load.

What's next for NyayaForensics AI

Advanced Forensic Parsers: Deep integration with traditional heavy-duty forensic frameworks like The Sleuth Kit (TSK), Plaso (log2timeline), and Volatility 3 for deep memory and disk image analysis.
Multimodal Evidence Expansion: Expanding the AI engine to handle advanced OCR, image manipulation forensics, audio/video analysis, and multilingual NLP parsing for diverse regional contexts.
Enterprise Production Hardening: Implementing WORM (Write Once, Read Many) secure object storage, hardware-backed key management, and advanced role-based access control (RBAC) for official deployment environments.