{"id":"https://openalex.org/W7225634874","doi":"https://doi.org/10.5281/zenodo.24085690","title":"How to Build a Second Brain for a Digital Investigation \u2014 A Case Study","display_name":"How to Build a Second Brain for a Digital Investigation \u2014 A Case Study","publication_year":2026,"publication_date":"2026-11-09","ids":{"openalex":"https://openalex.org/W7225634874","doi":"https://doi.org/10.5281/zenodo.24085690"},"language":"en","primary_location":{"id":"doi:10.5281/zenodo.24085690","doi":"https://doi.org/10.5281/zenodo.24085690","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24085690","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.5281/zenodo.24085690","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048753764","display_name":"Dirk Pawlaszczyk","orcid":"https://orcid.org/0000-0001-7485-7478","observed_orcids":["https://orcid.org/0000-0001-7485-7478"]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Pawlaszczyk, Dirk","raw_affiliation_strings":["Hochschule Mittweida"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023295736","display_name":"Dirk Labudde","orcid":"https://orcid.org/0000-0003-0466-0017","observed_orcids":["https://orcid.org/0000-0003-0466-0017"]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Labudde, Dirk","raw_affiliation_strings":["Hochschule Mittweida"],"raw_orcid":"https://orcid.org/0000-0003-0466-0017","affiliations":[{"raw_affiliation_string":"Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027223908","display_name":"Philipp Engler","orcid":"https://orcid.org/0000-0001-7279-8769","observed_orcids":["https://orcid.org/0000-0001-7279-8769"]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Engler, Philipp","raw_affiliation_strings":["Hochschule Mittweida"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106803005","display_name":"Ronny Bodach","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Bodach, Ronny","raw_affiliation_strings":["Hochschule Mittweida"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038763330","display_name":"Jan Kolouch","orcid":"https://orcid.org/0000-0003-2371-8376","observed_orcids":["https://orcid.org/0000-0003-2371-8376"]},"institutions":[{"id":"https://openalex.org/I4399657979","display_name":"Ambis University","ror":"https://ror.org/02z8bdw71","country_code":"CZ","type":"education","lineage":["https://openalex.org/I4399657979"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Kolouch, Jan","raw_affiliation_strings":["College of Regional Development and Banking Institute - AMBIS"],"raw_orcid":"https://orcid.org/0000-0003-2371-8376","affiliations":[{"raw_affiliation_string":"College of Regional Development and Banking Institute - AMBIS","institution_ids":["https://openalex.org/I4399657979"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148794762","display_name":"David KOV\u00c1\u0158","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4399657979","display_name":"Ambis University","ror":"https://ror.org/02z8bdw71","country_code":"CZ","type":"education","lineage":["https://openalex.org/I4399657979"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Kov\u00e1\u0159, David","raw_affiliation_strings":["College of Regional Development and Banking Institute - AMBIS"],"raw_orcid":"https://orcid.org/0009-0000-5572-3626","affiliations":[{"raw_affiliation_string":"College of Regional Development and Banking Institute - AMBIS","institution_ids":["https://openalex.org/I4399657979"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054853643","display_name":"Michael Spranger","orcid":"https://orcid.org/0000-0002-6780-0841","observed_orcids":["https://orcid.org/0000-0002-6780-0841"]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Spranger, Michael","raw_affiliation_strings":["Hochschule Mittweida"],"raw_orcid":"https://orcid.org/0000-0002-6780-0841","affiliations":[{"raw_affiliation_string":"Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5048437084","display_name":"Christian Hummert","orcid":"https://orcid.org/0000-0002-9932-3779","observed_orcids":["https://orcid.org/0000-0002-9932-3779"]},"institutions":[{"id":"https://openalex.org/I116397343","display_name":"Hochschule Mittweida","ror":"https://ror.org/024ga3r86","country_code":"DE","type":"education","lineage":["https://openalex.org/I116397343"]},{"id":"https://openalex.org/I4405263571","display_name":"Agentur f\u00fcr Innovation in der Cybersicherheit","ror":"https://ror.org/02yx7zx43","country_code":"DE","type":"government","lineage":["https://openalex.org/I4405263571"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Hummert, Christian","raw_affiliation_strings":["Agentur f\u00fcr Innovation in der Cybersicherheit, Hochschule Mittweida"],"raw_orcid":"https://orcid.org/0000-0002-9932-3779","affiliations":[{"raw_affiliation_string":"Agentur f\u00fcr Innovation in der Cybersicherheit, Hochschule Mittweida","institution_ids":["https://openalex.org/I116397343","https://openalex.org/I4405263571"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14171","display_name":"Education, Law, and Society","score":0.0,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/mobile-device-forensics","display_name":"mobile forensics","score":0.953000009059906},{"id":"https://openalex.org/keywords/digital-investigation","display_name":"digital investigation","score":0.7649999856948853},{"id":"https://openalex.org/keywords/wikis","display_name":"wikis","score":0.4410000145435333},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.5929999947547913},{"id":"https://openalex.org/keywords/entity-linking","display_name":"entity linking","score":0.6990000009536743},{"id":"https://openalex.org/keywords/timeline-reconstruction","display_name":"timeline reconstruction","score":0.9520000219345093},{"id":"https://openalex.org/keywords/ios","display_name":"iOS","score":0.3580000102519989},{"id":"https://openalex.org/keywords/android","display_name":"Android","score":0.968999981880188},{"id":"https://openalex.org/keywords/human-oversight","display_name":"human oversight","score":0.5109999775886536},{"id":"https://openalex.org/keywords/privacy-trade-offs","display_name":"privacy trade-offs","score":0.47099998593330383}],"concepts":[{"id":"https://openalex.org/C4438859","wikidata":"https://www.wikidata.org/wiki/Q186117","display_name":"Timeline","level":2,"score":0.7717999815940857},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.698199987411499},{"id":"https://openalex.org/C84418412","wikidata":"https://www.wikidata.org/wiki/Q3246940","display_name":"Digital forensics","level":2,"score":0.6980999708175659},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.6273999810218811},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.4724000096321106},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.4496000111103058},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.43070000410079956},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.39480000734329224},{"id":"https://openalex.org/C115925183","wikidata":"https://www.wikidata.org/wiki/Q1412694","display_name":"Knowledge-based systems","level":2,"score":0.37070000171661377},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.35569998621940613},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3546000123023987},{"id":"https://openalex.org/C2781357168","wikidata":"https://www.wikidata.org/wiki/Q5276084","display_name":"Digital evidence","level":3,"score":0.3508000075817108},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.3497999906539917},{"id":"https://openalex.org/C120567893","wikidata":"https://www.wikidata.org/wiki/Q1582085","display_name":"Knowledge extraction","level":2,"score":0.3352000117301941},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32510000467300415},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31949999928474426},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3163999915122986},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.310699999332428},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.29649999737739563},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.2904999852180481},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.27489998936653137},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.26989999413490295},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2671999931335449},{"id":"https://openalex.org/C98025372","wikidata":"https://www.wikidata.org/wiki/Q477538","display_name":"Systems architecture","level":3,"score":0.25429999828338623},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.25369998812675476}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.5281/zenodo.24085690","doi":"https://doi.org/10.5281/zenodo.24085690","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24085690","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24085691","doi":"https://doi.org/10.5281/zenodo.24085691","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24085691","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.5281/zenodo.24085690","doi":"https://doi.org/10.5281/zenodo.24085690","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24085690","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W7162455942","https://openalex.org/W7163851625","https://openalex.org/W4411445504","https://openalex.org/W7118008295","https://openalex.org/W4288054244","https://openalex.org/W3087698200","https://openalex.org/W7118002939","https://openalex.org/W6903994615","https://openalex.org/W2608488286","https://openalex.org/W2949016346"],"abstract_inverted_index":{"Mobile":[0],"forensic":[1,42,99,111,187],"investigations":[2],"generate":[3],"data":[4,70],"from":[5,155],"applications,":[6,83],"cloud":[7],"services,":[8],"and":[9,21,62,65,84,86,121,166],"devices.":[10],"Although":[11],"investigators":[12],"must":[13],"combine":[14],"these":[15],"sources,":[16],"systematic":[17],"records":[18],"of":[19,134,140,168],"interpretations":[20],"cross-case":[22],"relationships":[23],"are":[24],"often":[25],"lost":[26],"between":[27],"investigations.":[28],"This":[29],"study":[30],"applies":[31],"Karpathy's":[32],"\"second":[33],"brain\"":[34],"framework":[35],"to":[36,48],"mobile":[37],"forensics,":[38],"introducing":[39],"a":[40,77,125,176],"persistent":[41,186],"knowledge":[43,79,127,188],"architecture":[44,53,93],"as":[45,105],"an":[46,60,97,102,109],"alternative":[47],"retrieval-augmented":[49],"generation":[50],"(RAG).":[51],"The":[52,68,92,157],"comprises":[54],"three":[55],"levels:":[56],"immutable":[57],"source":[58],"data,":[59],"LLM-generated":[61],"maintained":[63],"wiki,":[64],"procedural":[66,87],"rules.":[67],"raw":[69],"layer":[71],"preserves":[72],"evidence;":[73],"the":[74,192],"wiki":[75],"provides":[76],"cross-referenced":[78],"base":[80,128],"covering":[81],"individuals,":[82],"timelines;":[85],"rules":[88],"define":[89],"case":[90],"workflows.":[91],"does":[94],"not":[95,152],"propose":[96],"LLM-based":[98],"analyst.":[100],"Instead,":[101],"LLM":[103],"operates":[104],"one":[106],"component":[107],"within":[108],"agent-driven":[110],"process.":[112],"Evaluation":[113],"on":[114],"two":[115],"Digital":[116],"Corpora":[117],"datasets":[118],"(iOS":[119],"17":[120],"Android":[122],"14)":[123],"produced":[124],"51-page":[126],"containing":[129],"525":[130],"internal":[131],"references,":[132],"99.6%":[133],"which":[135],"resolved":[136],"correctly.":[137],"Manual":[138],"verification":[139],"facts":[141],"against":[142],"build":[143],"logs":[144],"found":[145],"no":[146],"contradictions,":[147],"although":[148],"nearly":[149],"one-third":[150],"could":[151],"be":[153],"confirmed":[154],"documentation.":[156],"system":[158],"demonstrated":[159],"cross-application":[160],"entity":[161],"linking,":[162],"multi-time-zone":[163],"timeline":[164],"reconstruction,":[165],"detection":[167],"deliberately":[169],"hidden":[170],"or":[171],"deleted":[172],"data.":[173],"Comparison":[174],"with":[175],"locally":[177],"hosted":[178],"open-weight":[179],"model":[180],"highlights":[181],"quality/privacy":[182],"trade-offs.":[183],"Findings":[184],"support":[185],"management":[189],"while":[190],"underscoring":[191],"need":[193],"for":[194],"human":[195],"oversight.":[196]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}