{"id":"https://openalex.org/W7213949604","doi":"https://doi.org/10.3390/digital6040094","title":"AI-Driven Digital Forensics: A Systematic Review of Capabilities, Limitations, and Research Challenges","display_name":"AI-Driven Digital Forensics: A Systematic Review of Capabilities, Limitations, and Research Challenges","publication_year":2026,"publication_date":"2026-11-11","ids":{"openalex":"https://openalex.org/W7213949604","doi":"https://doi.org/10.3390/digital6040094"},"language":"en","primary_location":{"id":"doi:10.3390/digital6040094","doi":"https://doi.org/10.3390/digital6040094","is_oa":true,"landing_page_url":"https://doi.org/10.3390/digital6040094","pdf_url":null,"source":{"id":"https://openalex.org/S4210185390","display_name":"Digital","issn_l":"2673-6470","issn":["2673-6470"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/digital6040094","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5038937700","display_name":"Ahsan Ul Islam","orcid":"https://orcid.org/0009-0000-9525-4772","observed_orcids":["https://orcid.org/0009-0000-9525-4772"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Ahsan Ul Islam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086039015","display_name":"Narasimha Karpoor Shashidhar","orcid":"https://orcid.org/0000-0002-4877-158X","observed_orcids":["https://orcid.org/0000-0002-4877-158X"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Narasimha K. Shashidhar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5159617050","display_name":"A. B. M. Rezbaul Islam","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"A. B. M. Rezbaul Islam","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5084213893","display_name":"Wadduwage Shanika Perera","orcid":"https://orcid.org/0009-0007-6123-1805","observed_orcids":["https://orcid.org/0009-0007-6123-1805"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wadduwage Shanika Perera","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5038937700"],"corresponding_institution_ids":[],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"6","issue":"4","first_page":"94","last_page":"94"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14171","display_name":"Education, Law, and Society","score":0.0,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/explainability","display_name":"explainability","score":0.5339999794960022},{"id":"https://openalex.org/keywords/adversarial-robustness","display_name":"adversarial robustness","score":1.0},{"id":"https://openalex.org/keywords/reproducibility","display_name":"reproducibility","score":0.8809999823570251},{"id":"https://openalex.org/keywords/file-type-identification","display_name":"file type identification","score":0.7009999752044678},{"id":"https://openalex.org/keywords/file-carving","display_name":"file carving","score":0.7110000252723694},{"id":"https://openalex.org/keywords/biometric-recognition","display_name":"biometric identification","score":0.9589999914169312},{"id":"https://openalex.org/keywords/mobile-device-forensics","display_name":"mobile forensics","score":0.6510000228881836},{"id":"https://openalex.org/keywords/social-media-forensics","display_name":"social media forensics","score":0.8899999856948853},{"id":"https://openalex.org/keywords/drone-forensics","display_name":"drone forensics","score":0.9959999918937683},{"id":"https://openalex.org/keywords/internet-of-things-forensics","display_name":"Internet of Things forensics","score":0.8730000257492065},{"id":"https://openalex.org/keywords/blockchain-forensics","display_name":"blockchain forensics","score":0.9980000257492065},{"id":"https://openalex.org/keywords/cloud-forensics","display_name":"cloud forensics","score":0.9739999771118164},{"id":"https://openalex.org/keywords/network-forensics","display_name":"network forensics","score":0.7680000066757202},{"id":"https://openalex.org/keywords/memory-forensics","display_name":"memory forensics","score":0.8199999928474426},{"id":"https://openalex.org/keywords/human-ai-collaboration","display_name":"human-AI collaboration","score":0.6980000138282776},{"id":"https://openalex.org/keywords/benchmark-dataset","display_name":"benchmark dataset","score":0.3630000054836273}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.8309999704360962},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.7002000212669373},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6880999803543091},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.616100013256073},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.6157000064849854},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.5006999969482422},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.48500001430511475},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4016999900341034},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.39320001006126404},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35740000009536743},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.35429999232292175},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.3431999981403351},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.34220001101493835},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.34040001034736633},{"id":"https://openalex.org/C9114305","wikidata":"https://www.wikidata.org/wiki/Q1428317","display_name":"Situational ethics","level":2,"score":0.32919999957084656},{"id":"https://openalex.org/C518677369","wikidata":"https://www.wikidata.org/wiki/Q202833","display_name":"Social media","level":2,"score":0.32429999113082886},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3230000138282776},{"id":"https://openalex.org/C59519942","wikidata":"https://www.wikidata.org/wiki/Q650665","display_name":"Drone","level":2,"score":0.29330000281333923},{"id":"https://openalex.org/C207267971","wikidata":"https://www.wikidata.org/wiki/Q120208","display_name":"Emerging technologies","level":2,"score":0.29190000891685486},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C547195049","wikidata":"https://www.wikidata.org/wiki/Q1725664","display_name":"Terminology","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C170130773","wikidata":"https://www.wikidata.org/wiki/Q216378","display_name":"Usability","level":2,"score":0.2596000134944916},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.2551000118255615},{"id":"https://openalex.org/C2780262971","wikidata":"https://www.wikidata.org/wiki/Q44554","display_name":"Law enforcement","level":2,"score":0.25360000133514404}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/digital6040094","doi":"https://doi.org/10.3390/digital6040094","is_oa":true,"landing_page_url":"https://doi.org/10.3390/digital6040094","pdf_url":null,"source":{"id":"https://openalex.org/S4210185390","display_name":"Digital","issn_l":"2673-6470","issn":["2673-6470"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital","raw_type":"journal-article"},{"id":"doi:10.20944/preprints202609.1806.v1","doi":"https://doi.org/10.20944/preprints202609.1806.v1","is_oa":true,"landing_page_url":"https://doi.org/10.20944/preprints202609.1806.v1","pdf_url":null,"source":{"id":"https://openalex.org/S6309402219","display_name":"Preprints.org","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"posted-content"}],"best_oa_location":{"id":"doi:10.3390/digital6040094","doi":"https://doi.org/10.3390/digital6040094","is_oa":true,"landing_page_url":"https://doi.org/10.3390/digital6040094","pdf_url":null,"source":{"id":"https://openalex.org/S4210185390","display_name":"Digital","issn_l":"2673-6470","issn":["2673-6470"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["cwts-core","doaj","norway-1"],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5473999977111816,"display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4411208281","https://openalex.org/W4409737632","https://openalex.org/W7162299230","https://openalex.org/W4417331641","https://openalex.org/W7117978157","https://openalex.org/W7161827335","https://openalex.org/W4408632262","https://openalex.org/W7167603568","https://openalex.org/W7167641302","https://openalex.org/W7202260421"],"abstract_inverted_index":{"The":[0,130,181,218,246],"rapid":[1],"growth":[2],"of":[3,23,45,53,87,227,293,299],"digital":[4,24,92,302],"crime":[5],"through":[6],"cyber":[7],"intrusions,":[8],"ransomware,":[9],"social":[10,103],"engineering,":[11],"and":[12,21,38,48,60,74,84,108,121,146,167,179,194,214,232,243,260,275,282,297,304,311],"cloud":[13,36],"exploitation":[14],"has":[15],"substantially":[16],"increased":[17],"the":[18,43,51,133,207,225,238,294],"volume,":[19],"heterogeneity,":[20],"complexity":[22],"evidence.":[25],"Modern":[26],"investigations":[27],"span":[28],"mobile":[29],"devices,":[30],"operating":[31],"systems,":[32],"volatile":[33],"memory,":[34,97],"networks,":[35],"infrastructures,":[37],"emerging":[39],"environments":[40],"such":[41],"as":[42,111,113],"Internet":[44],"Things":[46],"(IoT)":[47],"blockchain,":[49,101],"challenging":[50],"scalability":[52],"conventional":[54],"forensic":[55,93,147,277,315],"workflows.":[56],"Artificial":[57],"Intelligence":[58],"(AI)":[59],"Machine":[61],"Learning":[62],"(ML)":[63],"offer":[64],"promising":[65],"capabilities":[66,296],"to":[67,137,176],"automate":[68],"evidence":[69,171],"analysis,":[70],"identify":[71],"complex":[72],"patterns,":[73],"accelerate":[75],"investigative":[76,115],"processes.":[77],"This":[78],"systematic":[79],"review":[80,131,247],"provides":[81,289],"a":[82,155,266,290],"comprehensive":[83],"critical":[85],"synthesis":[86],"AI/ML":[88,300],"applications":[89],"across":[90],"major":[91],"domains,":[94],"including":[95],"file,":[96],"network,":[98],"cloud,":[99],"IoT,":[100],"mobile,":[102],"media,":[104],"multimedia,":[105],"biometric,":[106],"vehicular,":[107],"drone":[109],"forensics,":[110],"well":[112],"cross-cutting":[114],"tasks.":[116],"A":[117],"structured":[118,291],"literature":[119,134],"search":[120],"eligibility":[122],"assessment":[123,292],"identified":[124],"76":[125],"studies":[126],"for":[127,199,240,307],"qualitative":[128],"synthesis.":[129],"synthesizes":[132],"with":[135],"attention":[136],"dataset":[138],"availability,":[139],"validation":[140],"practices,":[141],"reproducibility,":[142],"explainability,":[143,166,257],"adversarial":[144,168,258],"robustness,":[145],"admissibility.":[148],"Beyond":[149],"descriptive":[150],"synthesis,":[151],"this":[152,287],"study":[153,288],"introduces":[154],"six-dimensional":[156],"task":[157],"maturity":[158],"framework":[159,182],"based":[160],"on":[161,270],"observability,":[162],"labelability,":[163],"stationarity,":[164],"time-to-insight,":[165],"robustness.":[169],"An":[170],"audit":[172],"links":[173],"individual":[174,215],"ratings":[175],"supporting":[177],"references":[178],"qualifications.":[180],"assigns":[183],"literature-informed":[184],"ordinal":[185],"scores":[186],"using":[187],"explicit":[188],"dimensional":[189],"criteria.":[190],"Supporting":[191],"references,":[192],"rationales,":[193],"scope":[195],"limitations":[196,298],"are":[197],"documented":[198],"all":[200],"96":[201],"task-dimension":[202],"ratings.":[203],"Sensitivity":[204],"analysis":[205],"examines":[206],"same":[208],"profiles":[209],"under":[210],"alternative":[211],"weights,":[212],"thresholds,":[213],"rating":[216],"changes.":[217],"reference":[219],"mapping":[220],"does":[221],"not":[222],"independently":[223],"establish":[224],"validity":[226],"each":[228],"numerical":[229],"level.":[230],"Contextual":[231],"interpretive":[233],"judgment":[234],"remains":[235],"constrained":[236],"by":[237],"need":[239],"human":[241],"situational":[242],"legal":[244,261],"reasoning.":[245],"further":[248],"identifies":[249,305],"persistent":[250],"gaps":[251],"in":[252,301],"benchmark":[253,280],"datasets,":[254],"real-world":[255],"validation,":[256],"testing,":[259],"defensibility.":[262],"These":[263],"findings":[264],"motivate":[265],"research":[267],"agenda":[268],"centered":[269],"standardized":[271],"evaluation":[272],"protocols,":[273],"robust":[274],"explainable":[276],"AI,":[278],"improved":[279],"resources,":[281],"accountable":[283],"human\u2013AI":[284],"collaboration.":[285],"Overall,":[286],"current":[295],"forensics":[303],"priorities":[306],"developing":[308],"reliable,":[309],"transparent,":[310],"legally":[312],"defensible":[313],"intelligent":[314],"systems.":[316]},"counts_by_year":[],"updated_date":"2026-11-12T12:28:57.059296","created_date":"2026-09-22T00:00:00"}