This short paper brie y describes DigForASP, a COST Action that aims to create a cooperation network for exploring the potential of the application of logic-based Arti cial Intelligence in the Digital Forensics eld, and to foster synergies between these elds. Specifically, the challenge is to address the Evidence Analysis phase, where evidence about possible crimes and crimes perpetrators collected from various electronic devices (by means of specialized software, and according to speci c regulations) must be exploited so as to reconstruct possible events, event sequences and scenarios related to a crime. Evidence Analysis results are then made available to law enforcement, investigators, public prosecutors, lawyers and judges: it is therefore crucial that the adopted techniques guarantee reliability and veri ability, and that their result can be explained to the human actors.
An investigation consists, in general terms, in a series of actions and initiatives implemented by the investigators (law enforcement and judges) in order to ascertain the \truth" and acquire all possible information and data about a perpetrated crime and related facts with their logical implications. A large number of subjects are involved in this process, where they help to pursue a criminal activity, which could still be in progress. In an accurate vision, and according to the Italian Code of Criminal Procedure, investigations can be de ned as \the set of activities carried out by the o cers and agents of the criminal police". An investigation has, overall, the aim of establishing the existence of a crime and the consequences that it has determined (generic proof or \de delicto"), and identifying the criminals (speci c proof or \de reo").
These activities start from the act of acquisition of the crime notice or from the analysis of a crime scene. Through a series of initiatives and actions, the investigation allows the collection of data and elements which, according to certain deductive logical reasoning, should lead to draw conclusions. Investigative cases are usually complex, and involve a number of factors that need to be taken into account. Most of the collected data are nowadays obtained through digital devices and platforms either seized from the suspects, or available on the Internet or shared by telecommunication companies.
Digital Forensics (DF) is a branch of criminalistics which in fact deals with the identi cation, acquisition, preservation, analysis and presentation of the information content of computer systems, or in general of digital devices. In particular, the phase of Evidence Analysis involves examining and aggregating evidence about possible crimes and crime perpetrators collected from various electronic devices (by means of specialized software, and according to speci c regulations). This in order to reconstruct events, event sequences and scenarios related to a crime. Evidence Analysis results are made available to law enforcement, investigators, intelligence agencies, public prosecutors, lawyers and judges.
The COST Action DigForASP aims at creating a research infrastructure for the application of Arti cial Intelligence (AI), together with other complementary areas, in the eld of Digital Forensics. DigForASP constitutes a timely challenge for both areas: DF and AI. From the AI perspective, the proposed research infrastructure will foster the development of new theoretical results, methods and techniques that will contribute in the long term to the development of new software tools that will rely on a complex combination of concepts and results from di erent areas of Knowledge Representation (KR) and Automated Reasoning (AR) such as diagnosis, causal explanation, temporal reasoning about actions, epistemic reasoning, the treatment of incomplete knowledge, deontic and legal reasoning, inductive learning and formal concept analysis, which will be complemented by other ones needed for the purpose of the Action. At the same time, the application of (intelligent) automated tools to DF - capable of reliable and exhaustive exploration of evidence, and with a level of analysis that goes beyond the scope of human observation and in time - will constitute a breakthrough that will have a direct impact on the practical investigation of crime scenarios.
To meet the challenge, the Action has built a Network composed of researchers and engineers from the AI eld together with DF experts belonging to Government Institutions and NGOs alongside scholars from the eld of Information and Communication Technologies (ICT) and Law as well as social scientists, criminologists and philosophers (the latter for the ethical issues). The Network is carrying out a set of activities and building resources to promote interaction, exchange and cooperation between these di erent areas. It is enabling computer scientists to understand the main issues and open problems of Digital Forensics, especially Evidence Analysis, and it is helping to promote the exploitation of AI for addressing in an innovative, e ective and adaptive way the key problems in this domain. Network partners is thus being able to identify KR&AR techniques which can be applied to Evidence Analysis, and to suggest guidelines for creating and developing suitable new techniques and methods aimed at advancing the state of the art in both DF and AI, strengthening European research and innovation capability in these areas. The long-term objective of the Network is to increase know-how and competences, so as to devise and to implement concrete projects and tools to be applied by Police Scienti c Investigation Departments in solving real cases in COST Member Countries, COST Near Neighbour Countries (NNCs) and COST International Partner Countries (IPCs). This also by promoting coherent and e ective cooperation with third countries.
The paper is organized as follows: In Section 2 we illustrate in some detail what is Digital Forensics, and which is the state of the art in the application of automated tools in this eld. In Sections 3-4 we illustrate the progress that the DigForASP Action proposes over the state of the art, and the innovative aspects. In Section 5 we discuss the expected impact of the Action. In Section 6 we discuss the preliminary results achieved, and we conclude by discussing some future perspectives. 2
Digital Forensics is a complex and rapidly evolving eld, where methods for collecting evidence are varied, rapidly evolving and becoming increasingly sophisticated. In fact, such methods must continuously adapt to the evolution of technology. The aim is to identify digital sources of evidence, and to organize such evidence in order to make it robust in view of its discussion in court, either in civil or penal trials. DF is concerned with the analysis of possible sources of evidence after a crime has been committed.
Clearly, the development of DF is highly related to the development of ICTs in the last decades, and to the widespread di usion of electronic devices and infrastructures. It involves various disciplines such as computer science, electronic engineering, various branches of law, investigation techniques and criminological sciences. Organizational aspects are also relevant and DF investigation involves, in general, several experts working with sophisticated instruments and software, with limited resources and tight timing. DF is divided into sub- elds according to the kind of data analyzed, including those extracted from the Internet.
The DF process involves the following phases: 1. Identi cation, i.e. retrieving, via suitable forms of investigation, devices that may possibly contain digital data useful to the identi cation of a potential crime perpetrator, or anyway useful to help the investigators in their activities. 2. Acquisition, i.e., retrieving evidence in the form of data collected either from storage devices or from network interception. 3. Preservation, where collected evidence is be stored and preserved (according to speci c precise regulations) so as to guarantee integrity and authenticity. 4. Evidence Analysis, where the evidence collected is examined and aggregated to determine the existence of possible sources of proof that can be useful to law enforcement, investigators, public prosecutor, lawyers and judges in various phases of trial. It involves examining fragmented, incomplete knowledge, and aggregating evidence items into complex scenarios possibly involving time, uncertainty, causality and alternative possibilities. Currently, no single established procedure exists for Evidence Analysis, which is usually performed by Scienti c Investigation experts on the basis of their experience and intuition. 5. Presentation, where sources of evidence identi ed by means of Evidence Analysis are formalized in o cial documents.
Phases 1-3 are supported by a number of hardware and software tools, the latter being both proprietary and open source. These tools are continuously evolving to follow the evolution of the involved technologies and devices, and recently related procedures have been standardized in all communities. However, they do not require advanced reasoning capabilities. Phase 4, Evidence Analysis, is where the main thrust of the Action will lie. This phase requires advanced reasoning capabilities that are not currently supported by available devices and software. In fact, these are limited to data recovery (and data recognition) and to providing metadata (size, dates of creation/modi cation/elimination, etc.). Therefore, such retrieved data must be analysed by human experts, possibly with the support of available automated tools. However such tools, apart from text analysis, header les analysis and mining software packages, operate as a \black box" (i.e., they provide results without motivation or explanation), and for veri cation of the results one needs to perform a secondary analysis. 3
Evidence Analysis involves examining fragmented incomplete knowledge, and aggregation of evidence items into complex scenarios possibly involving time, uncertainty, causality and alternative possibilities. Currently, no single established procedure exists for Evidence Analysis, which is usually performed by Scienti c Investigation experts on the basis of their experience and intuition. The network is therefore focused on promoting formal and veri able AI methods and techniques for Evidence Analysis that aim at the elicitation of sources of evidence. Relevant aspects to consider include: { Timing of events and actions; { Possible causal correlations; { Contexts in which suspicious actions occurred; { Skills of the involved suspects; { Awareness of the involved suspects of committing a violation or a crime and of the degree of severity of the violation/crime.
Moreover, given available evidence, several possible underlying scenarios may exist that should be identi ed, examined and evaluated.The aim of the Action is that all the above should be performed via techniques that are veri able with respect to the results they provide, how such results are generated, and how the results can be explained. Therefore, such software tools can be reliable and provide a high level of assurance, in the sense of con dence in the system's correct behaviour. Otherwise there remains an undesirable uncertainty about the outcome of these stages, and di erent technicians analyzing the same case can reach di erent conclusions which may lead to di erent judgements in court.
In AI, several methods and techniques have been developed over the years for uncertain, causal and temporal reasoning, and for devising and examining alternative consistent scenarios that might be compatible with a set of known facts. To the best of our knowledge, these techniques have never been applied to Digital Forensics evidence analysis. Therefore, studying their applicability for development of suitable prototypes is per se a signi cant advance over the state of the art. Moreover, the application to such a challenging eld will foster re nements and improvements of the known methods and techniques, and development of novel ones.
Unlike the phase of crime identi cation or detection, where the exploration of big data and the application of Machine Learning (ML) techniques can be useful, the phase of Evidence Analysis has particular requirements that make the proposal of DigForASP based upon KR and AR a much more promising approach, potentially becoming a breakthrough in the state-of-the-art. The nal goal of Evidence Analysis is the formulation of veri able evidence that can be rationally presented in a trial. Under this perspective, the results provided by ML classi ers or other types of \black box" recommender systems do not have more value than human witness' suspicions and cannot be used as legal evidence. Logical methods provide a broad range of proof-based reasoning functionalities that can be implemented in a declarative framework where the problem speci cation and the computational program are closely aligned. This has the bene t that the correctness of such declarative systems based on Computational Logic can be formally veri ed. Moreover, recent research has led to new methods for visualising and explaining the results of computed answers (e.g., based on argumentation schemes). So one can not only represent and solve relevant problems, but also provide tools to explain the conclusions (and their proofs) in a transparent, comprehensible and justi ed way.
In summary, the rationale for the choice of Computational Logic relies on the fact that, by its very nature, it is based on precise formalizations, and thus allows for the a ordable veri cation of desired properties of the systems that will be devised in the future as a follow-up of DigForASP. Veri ability, reliability and justi ability are keys features for software tools to be applied in a eld such as Digital Forensics, where the evidence produced is aimed at the reconstruction of crimes and assist/facilitate the court in the decision process to establish if an accused is innocent or guilty. 4
Although AI techniques have been applied to DF for di erent purposes, they have mainly been exploited for data retrieval and categorization. For instance, the analysis of image and video multimedia les by pattern recognition algorithms or the detection of anomalies in large databases such as email exchanges, network transactions, etc. are examples of such applications. These tasks bene t from intelligent techniques and in particular from ML techniques. The Action takes a step beyond as it involves the main stakeholders in order to apply KR&AR methods to retrieved data in order to elicit evidence that can be used in a trial. For instance, from data items retrieved from di erent sources (like, e.g., mobile devices, social network activities, cloud computing tracks, etc.), we may obtain the set of all possible patterns of activity of a suspect during the execution of a crime. AR tools can constitute a crucial advantage since the amount of data to examine and interpret is large and keeps growing with the increasing adoption of digital devices in everyday life. Thus, the Action proposes innovations in the following two directions: 1) a substantial evolution of the current paradigm of evaluation and interpretation of data in DF analysis , which might be exportable, in the future, also to other Forensic Sciences; 2) a "breakthrough innovation" for the judicial system, based on the possibility of adopting intelligent, reliable and dependable decision-support systems for the reconstruction of facts, able to take into account the wide number of elements and variables involved in complex cases, so as to aid judges in their assessments and decisions. 5
The innovative use of methods and techniques from a well-established research els (AI, in particular KR and AR) to a critical eld (DF, in particular Evidence Analysis) where no signi cant previous e orts and results on computer-based intelligent decision support exist so far before, is already a potential breeding ground for new and signi cant scienti c and technological results. In the longterm, a challenging interdisciplinary area such as Digital Forensics will, with the help of this Action, provide a strong impetus for new developments that may result in scienti c breakthoughs, publications, software prototypes and tools. From the scienti c perspective, Evidence Analysis constitutes an ideal application domain for logical reasoning in AI, as it combines di erent classical aspects of knowledge representation and reasoning. Even the underlying orientation and goal, the search for a proof , is aligned in both areas (a formal proof vs a valid argumentation in a trial). In the short term, DF can provide the AI community with non-trivial benchmarks of automated reasoning that constitute a breakthrough with respect to available synthetic or ad hoc examples used in the scienti c literature. It will act as a proof of concept to check whether di erent available KR techniques and tools are directly applicable or, most probably, require adjustments to take into account the domain features.
From the socio-economical perspective, the use of AR tools will become, in the long-term, a positive bene t for all the involved stakeholders. Law enforcement, investigators, intelligence agencies, criminologists, public prosecutors, lawyers and judges will be provided with decision-support-systems that can effectively support them in their activities by providing motivated suggestions. In the short-term, the most relevant impact will be a twofold improvement both on e ciency and quality. On the one hand, investigators will work more e ciently thanks to new tools that guide them, helping with hypotheses formulation, the exhaustive application of case-based reasoning on large collections of data, and the development of proofs that can be formally checked with correct logic-based inference systems: this will save enormous e ort on tasks that are currently done by hand and in most cases require tedious repetitions to ensure that human errors will not spoil the validity of the nal evidence. On the other hand, once the evidence is obtained, Computational Logic tools allow the formal proof obtained to be presented in a form that can be understood and followed step by step by non-expert humans so it can be transparently used as a trial evidence. In the long-term, such methods could yield an evidence certi cate that will guarantee that an argument presented in a trial has been checked to be logically sound using a standardized formal veri er (in an analogous way to current applications of Formal Veri cation to Software Certi cations) and according to tests performed on a relevant number of real cases. This kind of certi cate could potentially allow ruling out cases of unintended (or intended) fallacies that are frequent in a purely rhetorical argumentation.
This long-term objective will be pursued and supported by the Action, where the inclusion of criminologists and criminal law experts in the network helps to ensure the uptake of the new technologies in the future. The new methods will also allow optimizing the use of available resources by relieving human experts from time-consuming and highly error-prone tasks that can instead be reliably performed by the future AI applications fostered by the Action results.
A potential risk concerning the proposed Action and its outcomes is that it may be di cult to convince the involved parties and the general public of the real applicability of such systems. While for some forensic techniques, such as DNA analysis, there is nowadays a high and widespread level of trust, an AI-based decision support system may initially appear unconvincing or even threatening. However, the general acceptance of DNA analysis paved the way for the introduction of other scienti c methodologies. The non-technical Action partners will be helpful in identifying and enacting strategies for transforming scienti c concept such as veri ability, completeness and correctness into humanistic and social concepts such as psychological reliability and trust, taking also into account speci c cultural, legal and ethical aspects. 6
Thanks to the experience gained over the years by investigators, via a study of
many existing solved cases we have been able to claim with good reason that
indeed a wide range of fragments of real cases can be mapped to computational
problems, often to known ones. Modern investigative activities are composed
of well-established practical steps, such as the crime scene reconstruction,
alibi veri cation, as well as the analysis of huge amounts of data coming from
data les, smart-phone and telephone logs. So, as a rst step we have devised
a formulation of these sample problems [
ASP has been selected for these rst experiments because of its easy of use
and readability, for the availability of e cient freely available inference engines
(\ASP solvers") and for the possibility of performing proof of correctness of the
software (the reader may refer to [
In a future perspective, we may notice that logical methods (like ASP) could
provide a broad range of proof-based reasoning functionalities (including, e.g.,
time and time intervals logic, causality, forms of induction, etc.) that can be
possibly integrated into a declarative framework for Evidence Analysis where
the problem speci cation and the computational program are closely aligned.
The encoding of cases via such tools would have the bene t that (at least in
principle) correctness of such declarative systems based on computational logic
can be formally veri ed. Moreover, recent research has led to new methods for
visualizing and explaining the results of computed answers (e.g., based on
argumentation schemes). So, one could not only represent and solve relevant
problems, but might also employ suitable tools to explain the conclusions (and their
proofs) in a transparent, comprehensible and justi ed way. The engine of such
a future Decision Support System might be based, again remaining within a
computational logic realm, on Multi-Context Systems (MCS) [2{4] and their
agent-oriented extensions such as DACMACS (Data-Aware Commitment-based
managed Multi-Agent-Context Systems, [