AI & Digital Forensics - Review of Eoghan Casey (2026) It's up to us what AI....

Review of Casey's 2026 Article:  Itʼs up to us what AI and the next generation learn about Digital Investigation

The purpose of this report is to review suggested guidelines for the appropriate use of artificial intelligence (AI) in digital forensic based on Eoghan Caseyʼs (2026) article, “Itʼs up to us what AI and the next generation learn about Digital Investigation.” The central concern in the article is the relationship between forensic knowledge, practitioner competence, and AI reliability: Casey says, “Despite our progress, a fundamental problem persists: getting knowledge into practice” (Casey, 2026, p. 1).

The report addresses accountability in AI-assisted casework, the use of validated and structured knowledge, knowledge sharing, and the consequences of failing to apply established forensic knowledge. Casey states, “Any AI system used in casework must show how it reached a result and where the underlying knowledge came from” (p. 2). The guidelines below organize the Casey's statements into practitioner-facing recommendations; they do not introduce external requirements or additional research findings.

Recommendations from Casey's Article

• Require AI systems to explain their results and identify their knowledge sources. “Any AI system used in casework must show how it reached a result and where the underlying knowledge came from” (p. 2). This statement establishes Casey's explicit requirement for AI use in digital forensic casework.

• Ground AI use in validated, structured knowledge with verifiable sources. Casey describes the intended foundation for AI reliability: Grounding a model in validated, structured knowledge gives it a solid foundation to reason from, stops it from guessing, and links every result to sources a person can verify and cite (p. 2).  This recommendation follows the Casey's stated approach to grounding models; the article does not provide testing results demonstrating that grounding eliminates guessing.

• Curate forensic knowledge in formats accessible to both people and machines. “We must curate our collective knowledge into formats that are readable by both humans and machines” (p. 1). Casey identifies “papers and presentations,” “catalog entries in NIST Digital Forensics Artifact Catalog,” “knowledge bases of techniques such as SOLVE-IT,” and “ontologies such as CASE and UCO” as relevant formats (p. 1).

• Use complementary knowledge formats to preserve reasoning and support casework. Casey explains the distinct contributions of different formats: Using more than one format is better: a paper details the background and reasoning, a presentation summarizes key points, a SOLVE-IT technique articulates how to mitigate weaknesses in casework, and an ArtCat entry specifies the meaning of atomic artifacts (a singular unit of interpretable data that answers an investigative question) (p. 1).

• Apply established standards, definitions, and structured concepts in practice. “Getting these standards and definitions adopted in practice is our ongoing challenge” (Casey, p. 1). The author further states that “the discipline of representing knowledge in a structured format, including ontology-backed concepts and definitions, makes us think deeply about how something works in the real world” (p. 1).

• Do not present tool output as unquestionable fact or disregard uncertainty. Casey identifies the problem of “a toolʼs output presented as incontrovertible fact with no acknowledgment of its uncertainty” (p. 1). His accompanying warning is explicit: “An answer that is invented or unexplained is a liability in digital investigations” (p. 2).

• Contribute practical knowledge to searchable forensic resources. “If you have an afternoon, add entries to ArtCat or SOLVE-IT, making your knowledge searchable by people and machines, and raising the visibility of your work internationally” (p. 2). The author explains that such entries “raise awareness of referenced publications and put them in a form that is searchable by individuals and tools” (p.1).

• Support the peer-reviewed knowledge base through reviewing and publication. Casey recommends, “If you have a few hours, volunteer as a peer reviewer,” and, “If you have more time, plus a good idea, submit your work to the Journal or the Digital Forensics Conference CFP” (p. 2). He connects these contributions to future AI reliability: “The peer reviewed knowledge we publish, catalog, and formalize over the next few years will determine how trustworthy the next generation of tools will be” (pp. 1–2).

Risks and Weaknesses

The article identifies both AI-specific risks and existing digital investigation weaknesses that careless AI use may amplify. 

• Careless AI use may amplify existing flaws. “Applied carelessly, AI is an amplifier, accelerating our existing flaws while adding new ones” (p. 1).

• Investigators may rely on AI without recognizing its risks. “Now many will default to using AI systems for answers without realizing the risks” (p. 2).

• Invented or unexplained answers create investigative liability. “An answer that is invented or unexplained is a liability in digital investigations” (p. 2).

• Tool output may be treated as certain when it is not. Casey identifies “a toolʼs output presented as incontrovertible fact with no acknowledgment of its uncertainty” (2026, p. 1).

• Established knowledge may fail to reach practitioners.“I am not describing negligence. I am describing what happens to competent people when the knowledge they need exists but never reaches them” (p. 1).

• Improper handling and incorrectly implemented searches can compromise examinations. Casey identifies “a smartphone rendered inaccessible because it was not handled properly” and “key evidence missed due to an incorrectly implemented keyword search” (2026, p. 1).

• Outdated methods can contribute to backlogs and disclosure failures. “It is backlog accumulation and disclosure failures because of outdated methods being used” (p. 1).

• Nonstandard data formats and undocumented solutions can waste investigative time. Casey describes “days spent making sense of data delivered in a bespoke format because no standard schema was used” and “weeks lost to a problem that a colleague solved a year ago but never wrote down” (2026, p. 1).

• Mishandling or misinterpretation can result in excluded evidence and disrupted cases. “It is evidence excluded because of mishandling or misinterpretation, causing a case to be rebuilt or stopped” (p. 1).

• Community knowledge resources depend on practitioner participation. “Behind every paper published and conference held is a modest number of passionate people who say yes to volunteer their time and talent” (p. 1). The author concludes that “we just need to get better at making it easier to access and adopt in practice” (p. 2).

AI Use Statement

Perplexity AI was used in the development of this information.

References

Casey, E. (2026). Itʼs up to us what AI and the next generation learn about digital investigation. Forensic Science International: Digital Investigation, 58, Article 302204. https://doi.org/10.1016/j.fsidi.2 026.302204

Perplexity AI. (n.d.). Perplexity [Large language model]. https://www.perplexity.ai/

 

Cite this page:

Kardasz, F. (2026, October). AI & Digital Forensics -  Review of Eoghan Casey (2026) It's up to us what AI.... https://kardasz.blogspot.com/2026/10/ai-digital-forensics-review-of-eoghan.html