AI & Digital Forensics - Review of Parkinson & Kahn (2024) The role of Artificial Intelligence…

Parkinson & Kahn (2024) The role of Artificial Intelligence…

This report presents guidelines for the appropriate use of artificial intelligence (AI) in digital forensic examinations, based exclusively on The role of Artificial Intelligence in digital forensics: Case studies and future directions, by Simon Parkinson and Saad Khan (2024). The authors describe their purpose as follows: “we discuss the types of AI and how they can be used in digital forensic processes, providing examples, and highlighting potential challenges that are likely to be experienced in developing and adopting them” (Parkinson & Khan, 2024, p. 43).

Scope

The article focuses on investigations involving Indecent Images of Children (IIOC). The authors explain that these investigations “still have parallels with all other digital investigations that follow the same process model” (p. 43). The research considers two principal applications: “a DDM (Data Driven Model) approach involving the use of machine learning to classify images based on the age of individuals” and “an MBR (Model Based Reasoning) prioritisation approach where a multi-stage investigation is optimised to handle multiple concurrent cases” (p. 44). The recommendations below translate the articleʼs stated applications, findings, and cautions into practitioner guidelines. Supporting quotations use the articleʼs printed page numbers, 42– 47, rather than the PDFʼs page sequence.

Parkinson & Kahn - Recommendations

• Select the AI approach according to the investigative task. Use MBR for modelling and automating established investigative processes, and DDM for sorting or analysing evidence. The authors state that “MBR approaches are typically used for automating and representing well-known processes” and that “DDM approaches are typically used for applications where data requires sorting or processing to identify aspects of interest or identify new insights” (p. 44). 

• Use AI to assist with large-volume evidence analysis and pattern recognition. Apply AI where the volume of evidence makes manual processing excessively time-consuming. The authors identify the benefit that “large volumes of data can be processed efficiently, saving the investigator time, and more quickly identifying any information pertinent to the case” (p. 46). 

• Align age-classification training with the examination objective. Use sufficient labelled training data and train the algorithm for the classification task it is intended to perform. The article states: “There needs to be sufficient labelled data available (i.e.assigned a known class) for training the algorithm and the algorithm should be trained according to the classification aim” (p. 44). When the objective is to distinguish children from adults, consider binary classification rather than exact-age prediction. The authors explain that it may be “more appropriate and advantageous for the algorithm to be trained to predict whether the individual is a child or an adult (binary classification) rather than trying to predict the actual age (regression)” (p. 44). 

• Recognize the reported performance limits of age classification. Treat the reported findings as experimental results, not as evidence of error-free classification. The authors report: “The algorithm demonstrated that in 90% of cases, it could correctly separate images into child (<18 years of age) and adult (≥18 years of age) classes.” They also state that “the time to analyse each image is less than 0.5 seconds” (p. 44). 

• Use MBR to support resource allocation and concurrent case processing. Consider automated planning for multi-stage investigations where available resources must be shared between cases. The authors describe “automated solutions that are capable of dynamically allocating and optimising resources” and state that “optimisation of the process can enable concurrent case handling”. Use task and workload information to inform planning. The article explains that “sensory input (e.g. number of files to analyse) can be used to select the most appropriate task to perform” (p. 45). 

• Use relevant discoveries to inform case prioritisation when computing resources are limited. In the IIOC context examined by the authors, incorporate findings of interest into resource allocation decisions. The article states that “information regarding any findings of interest (e.g. IIOC images discovered) can be used to prioritise case investigations where computer resources are limited”. The reported finding was that “Empirical analysis of 5 case studies resulted in a reduction of 36% in processing time” and “a 26% reduction in time required to discover IIOC content”(p. 45). 

• Keep process models focused on necessary investigative elements. Ensure that process modelling draws on knowledge of both digital forensics and AI, without introducing unnecessary complexity. The authors specify that modelling requires “a good understanding of both the problem domain and AI technology” and that “only key and necessary aspects are modelled to avoid them becoming overly complex” (p. 46).

• Emphasize traceable decisions and understandable outputs. Use AI decision-making and optimisation with attention to the authorsʼ stated benefit that “verifiable and traceable decisions can be made in complex situations”. Examiners should also understand the system sufficiently to evaluate its outputs. The article cautions that “the output of AI systems o en requires further explanation and understanding of how the AI system works to evaluate outcomes” (p. 46).

• Consider natural language processing and anomaly identification as additional applications. Consider AI-assisted text analysis where the objective is “to interpret the text and identify parts of significance.” Consider DDM approaches for behavioural or predictive analysis where “information can be profiled to identify routine and anomalous data sets” (p. 46).

• Address specialist skills, predictable behaviour, and computing capacity before implementation. Ensure that implementation accounts for the authorsʼ warning that “the development, deployment and maintenance of AI systems require specialist skills and expertise that are currently in short supply”. Address reliability by considering the authorsʼ requirement that “The system needs to be deterministic – i.e. its behaviour must be fully predictable and known.” Account for infrastructure demands because “AI systems require significant computing resources” (p. 46).

Issues, Challenges and Pitfalls

• Training-data availability and suitability. The authors identify difficulties that “o en centres around the availability and use of data.” They specify the need for “sufficient labelled data” and training “according to the classification aim” (p. 44).

• Difficulty predicting exact age. The article cautions: “Predicting actual age is challenging because individuals age at different rates and identifying unique visual characteristics for a specific age (e.g. 25) may not be possible” (p. 45).

• Investigator welfare during manual image inspection. The authors identify that “manually inspecting each will be time-consuming and detrimental to investigator welfare” in cases involving high quantities of suspected IIOC images (p. 44).

• Dependencies between investigative stages and so ware tools. The article reports that “Dependencies between stages and different so ware tools result in a slow case processing duration of 13-25 days per case” (p. 45).

• Process-model development and excessive complexity. The authors identify “challenges with this approach when it comes to creating the model of the process being automated and optimised.” They caution that models should include “only key and necessary aspects” to prevent them from becoming “overly complex” (p. 46).

• Need for further testing at greater scale and within law enforcement agencies. The authors state that “further experimentation will be undertaken to examine the approachʼs capability when handling a larger number of cases.” They also identify planned “trials within LEAs” that “will enable access to real historic cases” (p. 46).

• Shortage of specialist skills. The article states that AI development, deployment, and maintenance require expertise “currently in short supply” and explains that “the growth of AI systems is vastly outpacing the new employees” (p. 46).

• Interpretability and explainability. The authors caution that “the output of AI systems o en requires further explanation and understanding of how the AI system works to evaluate outcomes” (p. 46).

• Legal, ethical, and reliability concerns. The authors state that AI use “comes with challenges and enters into unknown territory.” They further warn: “Any unexpected behaviour could be problematic and cast doubt over reliability, which could prove problematic to defend” (p. 46).

• Computing-resource and budget constraints. The article identifies that “AI systems require significant computing resources – something not available within LEAs due to budgetary constraints” (p. 46).

• Cloud-processing and data-breach risks. The authors caution that “the use of cloud computing resources might not be possible” because uploading case data for processing “would therefore pose a potential risk if there are data breaches” (p. 46).

AI Use Statement

Perplexity AI was used in the development of this information.
 

References

Parkinson, S., & Khan, S. (2024). The role of artificial intelligence in digital forensics: Case studies and future directions. Assessment & Development Matters, 16(1), 42–47. https://doi.org/10.53 841/bpsadm.2024.16.1.42

Perplexity AI. (n.d.). Perplexity [Generative AI tool]. https://www.perplexity.ai/

 

Cite this page:

Kardasz, F. (2026, October). AI & Digital Forensics -  Review of Parkinson & Kahn (2024) The role of Artificial Intelligence…  https://kardasz.blogspot.com/2026/10/ai-digital-forensics-review-of_050002949.html