In today's technology-driven legal landscape, practitioners must continually adapt to new tools and methods that aid not only in addressing cybercrime but also in managing traditional crimes with digital components. This paper explores the potential of advanced AI-powered solutions, such as ChatGPT, in enhancing the capabilities of investigators in various aspects of their investigations. We delve into three specific applications pertinent to legal professionals: (1) writing structured queries utilizing natural language and trace models, (2) summarizing, evaluating, and visualizing electronic communications, and (3) analysing search results. Our findings demonstrate that once ChatGPT is proficient in the query language and data model of the system containing the digital evidence, it holds significant promise in assisting legal professionals in conducting efective investigations.
Deep learning is a subset of machine learning that focuses on artificial neural networks with multiple layers. These networks can automatically learn representations from raw data and have demonstrated significant success in various domains, including computer vision, natural language processing, and speech recognition [4].
Large language models, such as GPT-3 [5], are a spe
The legal profession is witnessing a significant surge in the adoption of artificial intelligence (AI) tools, with ChatGPT emerging as a prominent development since November 2022 [1]. Powered by OpenAI’s advanced large language model, ChatGPT ofers a natural and engaging conversational interface on an extensive array of topics encountered during its training. ChatGPT’s web application provides users with access to various models, including the Default GPT-3.5 turbo (a refined and superior version of GPT-3), Legacy GPT-3.5 (the preceding ChatGPT model), and GPT-4 (the most sophisticated model, exclusively accessible to ChatGPT Plus subscribers). The experiments discussed in this paper employ the ChatGPT/GPT-4 model, which showcases its potential applications in the domain of digital evidence investigation.
ChatGPT has been fine-tuned with Reinforcement Learning from Human Feedback (RLHF), e.g., human reviewers have trained the model to be “helpful, honest and harmless”, i.e., to not use undesirable language (violent, sexist, racist, etc.) in conversations. Also, in some cases reviewers were asked to write example responses for a chatbot. ChatGPT has learned what useful answers are, so that conversations flow smoothly. Employing people to review thousands of prompts is costly and seems to be one of ChatGPT’s key success factors.
ChatGPT and large language models (LLMs) in general are often seen as statistical machines that have learned to predict the next word based on the sequence of preceding words [2]. The word ‘statistical machine’ might be misleading since there seems to be much more to a large language model then simply predicting the next word. For instance, Shanahan [3] talks about what LLMs actually do, how they compare to humans and about unexpected emerging behaviour. A more accurate description could be that ChatGPT has learned an algorithm to predict the next word.
Nonetheless, ChatGPT is certainly not flawless. It makes mistakes and sometimes hallucinates facts which is considered a dangerous aspect. However, when used as an assistant and when properly instructed, it can be a smart student that is able to help digital forensic experts more eficiently and efectively investigate cases with digital evidence it has never seen before.
In this paper we describe the rise of ChatGPT followed by prospective applications in digital investigation and an overview of related work. We then present empirical results from three experiments, followed by an evaluation, discussion and conclusions. 2. The rise of ChatGPT vast amounts of text data, enabling them to generate LegalAIIA2, e.g., network-based filtering for large email human-like text and perform various language-related collections [16], semantic search in eDiscovery [17] and tasks with high accuracy. The development of large lan- technology assisted analysis of timeline and connections guage models has significantly advanced the capabilities in digital forensic investigations [18]. The experiments of AI systems, allowing them to generate text in a more in this paper will touch on similar topics but are focused context-aware and coherent manner. on the application of ChatGPT. We discuss the relevance
The GPT-4 architecture that is underlying ChatGPT of three specific tasks in digital evidence investigations. is one such large language model. It is trained using a diverse dataset, including books, articles and web pages, 3.1. Writing structured queries utilizing enabling it to generate contextually relevant responses natural language and trace models to text inputs. Its architecture allows it to capture longrange dependencies and generate coherent responses One of the primary challenges faced by investigators across a wide range of topics. is eficiently querying vast amounts of digital evidence.
Large language models have found success in several Typically, investigators need to have a thorough underapplications outside the field of digital evidence inves- standing of forensic data models and query languages, tigations. For instance, they have been used to gener- such as SQL, to retrieve relevant information from digital ate coherent and context-aware text for creative writ- evidence. This can be a time-consuming and complex proing [6, 7], assist with code generation and programming cess, especially for investigators with limited technical tasks [8], and provide relevant answers to questions in expertise in this area. customer support scenarios [9, 10]. These models have The ability to convert natural language queries into also demonstrated capabilities in tasks such as machine structured queries can significantly streamline the intranslation [11] and summarization [12], showcasing vestigative process. By allowing investigators to simply their versatility and potential across various domains. describe their query in everyday language, large language
Finally we note that ChatGPT is also heavily debated models can generate the corresponding structured query in the field of law and legal services. For instance, in a that retrieves the relevant information. This not only panel discussion hosted by the Northwestern Law and saves time and efort but also reduces the potential for Technology Initiative and the High Tech Law Society[13] errors caused by incorrect or incomplete queries. panelists discussed the potential and limitations that ChatGPT has for various legal tasks, such as drafting 3.2. Summarize, evaluate and visualize contracts and briefs, providing legal advice, and automating legal reasoning. A few months later ChatGPT/GPT-4 chat messages passed the Uniform Bar Examination with a score of Chat conversations often play a critical role in digital 297, which is higher than the passing threshold of any evidence investigations, as they can provide valuable jurisdiction and nears the 90th percentile of human test- insights into the activities, intentions, and relationships takers [14, 15]. The consensus in the field of law and of individuals involved in illicit activities. Analyzing legal services seems to be that ChatGPT is a powerful chat conversations can be a labor-intensive and timetool that could be transformative, but also requires care- consuming task, particularly when dealing with lengthy ful evaluation and regulation to ensure its responsible or complex chat logs involving multiple participants. use. Text summarization is an active research field since the 1950s [19]. It gained increased attention with the growth 3. Prospective applications of the Internet and multimedia technology, which led to an exponential surge in text data. With the advent of emerging technologies, new challenges have arisen, including handling multimodal inputs, generating summaries across diferent domains and languages, ensuring coherence, readability, and objective and subjective evaluation of summaries. Traditional summarization technologies, such as statistical methods, rule-based methods, and neural network methods, had limitations in terms of hand-crafted features, data sparsity, and generating generic summaries. Large language models mitigate Digital forensics and eDiscovery are vital fields that involve the identification, preservation, analysis, and presentation of digital evidence (often referred to as Electronic Stored Information or ESI) in legal proceedings.
As technology continues to evolve and data volumes grow exponentially, the need for advanced tools and techniques to eficiently process, analyze, and interpret digital evidence becomes increasingly important.
In the past, we experimented with AI applications for eDiscovery related tasks and reported results and ideas at
1Workshop on Discovery of Electronically Stored Information http: //users.umiacs.umd.edu/~oard/desi7/ 2International Workshop on AI and Intelligent Assistance for Legal Professionals in the Digital Workplace https://sites.google.com/vie w/legalaiia2019 some of these limitations by harnessing more data and seen before, it is familiar with the well-known Enron computational resources, positioning themselves as a case [22], which has been extensively discussed on the promising solution for summarization tasks [20], despite Internet and is frequently used in eDiscovery education. the ongoing challenges of ensuring factual consistency, When asked to provide examples of how Enron violated diversity, and controllability. U.S. Federal Government accounting standards, ChatGPT
By utilizing large language models to automatically efortlessly and impressively answered, likely drawing summarize chat conversations, investigators can quickly from sources such as Wikipedia and numerous online gain an understanding of the key points and themes dis- publications that analyze Enron’s downfall. cussed within the conversations. This enables them to Such analyses, of course, do not exist in new investigafocus their attention on the most relevant content, mak- tions. The key question raised by the authors is whether ing the investigation process more eficient. Moreover, ChatGPT can also analyze documents in new investigasummarization can also aid in the presentation of dig- tions, as such analyses do not exist for cases it is unfamilital evidence in court, as it allows for a more concise iar with. In a limited test, ChatGPT was able to determine and accessible representation of complex chat logs for the relevance of an email from the Enron dataset when non-technical audiences, such as judges and jurors. given a specific question. It could also explain the reason for its relevance. However, this approach may not be 3.3. Analysing search results applicable to new cases, as the underlying GPT-3 model has not been trained on information about them. Such Since ChatGPT is capable of conducting a dialog and new information can be learned by GPT-3. OpenAI ofers remembers previous prompts and responses, we perform the ability to fine-tune models in the cloud. But that is an experiment where we introduce a fictitious case. We costly, and lawyers are reluctant to upload their clients’ present diferent sets of search results to ChatGPT and sensitive documents. That situation is likely to change as ask for an analysis, e.g., see if traces are correlated and if alternatives to ChatGPT /GPT-4 that can run on-premise ChatGPT can provide a narrative. are already emerging [23, 24, 25].
If ChatGPT can analyse search results and is able to This related work demonstrates that large language correlate and group results from search queries with dif- models, like ChatGPT, have the potential to be valuable ferent types of digital evidence, this will show that Chat- tools in the eDiscovery domain, particularly for tasks GPT is aware of the case context which will make it a such as constructing complex boolean queries and demuch more efective copilot for digital investigations. termining the relevance of specific documents. However, as the authors have pointed out, the efectiveness 4. Related work of ChatGPT in new investigations remains a concern, as its knowledge is limited to the information it has been trained on. Nevertheless, the success of ChatGPT in the context of the Enron case serves as a promising indication that these models can contribute significantly to the Digital evidence investigations have many things in common with other types of investigations and work-related tasks that are common place in all lines of work, such as report writing, researching open sources on the inter- field of digital forensics and legal technology, provided that their limitations are addressed and overcome. net, writing software and taking notes. We covered the success of ChatGPT in these areas shortly in Section 2.
In this section, we cover related work on the application of ChatGPT to tasks that are more specifically linked to digital evidence investigation.
Recent advances in large language models, particularly those based on GPT-like architectures, have significantly improved the generation of SQL queries from natural lan4.1. eDiscovery tasks guage inputs. The study of neural text-to-SQL systems In the realm of legal technology, specifically eDiscovery, has become a“highly competitive and fast paced research other researchers have also recognized the potential of ifeld” [ 26]. Earlier approaches relied on sequence-toChatGPT in assisting with various tasks. In “What Will sequence networks to generate SQL queries, but models eDiscovery Lawyers Do After ChatGPT?” [21], Treden- such as GPT-3 and its descendants already demonstrated nick and Webber discuss the capabilities and limitations promising results. Mannelly (2022) [27] demonstrates of ChatGPT when applied to common eDiscovery tasks. how GPT-3 can be used to generate SQL queries from
The authors conducted a series of experiments where plain English text using NBA data, showcasing the pothey asked ChatGPT to construct complex boolean tential of GPT-3 in transforming natural language inputs queries based on fairly simple questions. While Chat- into structured SQL queries. In a more practical appliGPT cannot answer queries about information it has not cation, Alexander (2023) [28] provides a step-by-step guide on using ChatGPT to write SQL JOIN queries and 4.2. Formulating SQL and Cypher queries demonstrates the use of dbForge Studio for SQL Server evaluating the contents of a chat conversation indicating to verify and test the generated queries. These recent de- if it is relevant for the criminal investigation or not. velopments highlight the potential of GPT-like models in Related to this, also at ICDDF 2023, senior responsirevolutionizing the way SQL queries are generated from ble oficer T. Baker, from the UK Police Digital Service 4, natural language inputs, opening up new possibilities for referred to an experiment where technology similar to database management and investigating digital evidence. ChatGPT was successfully tested to support the disclo
The use of large language models to transform natural sure process. Disclosure is a fundamental part of fair language queries into structured queries that are less well criminal investigations and trials, but Rape and Serious known than SQL has also gained attention, as exemplified Sexual Ofences cases can present particular challenges by an online article that explores the application of GPT-3 given the volumes of potentially relevant digital material in transforming English natural language questions into generated. For example, the police and the Crown ProsCypher queries for the Neo4j graph database [29]. This ecution Service may need to review messages, photos, work is closely related to our article, as it demonstrates videos, or location history from the phones or computers the potential of large language models, such as GPT-3 of the victims and suspects. This can be time-consuming and ChatGPT, in assisting digital forensic experts and and resource-intensive, and may also raise privacy and investigators in converting natural language queries into consent issues for the parties involved. a structured format, other than SQL, that takes advantage of specific data models and query languages.
In the article, the authors describe their experiments us- 5. Experiments ing GPT-3 to “understand” and process natural language queries and generate corresponding Cypher queries that In this section we first illustrate how ChatGPT can utilize can be used in the context of the Neo4j graph database. a digital trace model and how it can then be instructed This is a powerful application, as it allows users to ask to formulate structured queries based on natural lanquestions in everyday language and receive accurate re- guage input from an investigator. Next we present chat sponses from the database without requiring knowledge conversations to ChatGPT and ask for various types of of the underlying query language or data model. By re- summarization, including semantic analysis and network ducing the complexity and technical barriers associated visualisation. In the third experiment we interact with with querying graph databases, large language models ChatGPT via a series of prompts with facts from a fictican empower a broader range of users to access and an- cious case and query results containing browser history, alyze the wealth of information contained within such chat messages and geo locations. databases. 3The annual conference on International Communications Data and
4PDS Digital Forensics supports the implementation of the National
5For more information, see https://hansken.org/ 4.3. Semantic search and relevance determination
Cullen presented on the “Practical application of artiifcial intelligence to solve Digital Forensic challenges”. He described an experiment illustrating the capability of ChatGPT to search semantically and multilingual. In the example ChatGPT was asked about a car and Cullen demonstrated that ChatGPT would not only find ‘car’ but would also find ‘Mercedes’ and even was not bothered if the text was presented in Arabic.
In another experiment illustrating the use of ChatGPT, Cullen explained that in the UK victims of crime (including rape complainants) are asked for permission to view all data including messages, photographs, emails and social media accounts. Victims’ groups say this amounts to a “digital strip search” [30]. Cullen reported that ChatGPT is capable of protecting the privacy of a victim by 5.1. Writing structured queries utilizing natural language and trace models
platform for law enforcement and intelligence agencies to search and analyze digital traces from seized digital devices such as phones and computers. Hansken has been around for more than 10 years and was developed by the Netherlands Forensic Institute. It is based on Hadoop and Elasticsearch, among others, making it capable of processing and storing petabytes of digital data.
Hansken processes digital traces using a trace model. Using the Hansken Query Language (HQL), these traces can be searched in the elasticsearch database with excellent performance, even in cases with hundreds of terabytes of seized data that have hundred million traces or more. HQL is a powerful language similar to other query languages such as SQL but is completely focused on the Hansken trace model. ChatGPT can start learning to transform questions in plain language into HQL syntax by prompting it with text from the Hansken HQL manual. Figure 1 depicts the first part of this manual, to get an idea of the type of information in it.
To be able to apply the HQL syntax it is necessary to understand the Hansken trace model. In a follow up prompt we first introduce the Hansken trace model: HQL searches for Hansken traces. A trace is a structured data object. The object contains intrinsic properties, which are mandatory properties for every trace, such as name and id. Furthermore, a trace can contain origins like system or user. This origin describes where the data is coming from. An origin contains categories, like extracted or processed. Every category has a list of allowed types, which are listed below. Every type contains properties, for example type email contains from or to. The combination of origins, categories, types and properties leads to a nested data structure. When using the Hansken Query Language, both origin and category are omitted. This means you can find emails using email.from:' bob@domain.com', not via system.extracted.email.from:' bob@domain.com'. This also explains why a trace can not contain both system.extracted.email.from and user.extracted. email.from, as they would point both to the same type and property.
After this introduction we present the trace model for a number of selected trace types (e.g. email, chatMessage, picture and file). Figure 2 illustrates how the email trace type is defined.
Finally we also present HQL examples that are listed in the Hansken HQL cheat sheet. A section of the cheat sheet is depicted in Figure 3.
After these prompts we prompted ChatGPT with a
question asking to produce a HQL query that finds emails
with attachments sent between July 1 and July 28, 2022:
Find email traces with attachments sent between July 1 and
July 28, 2022 in HQL
Initially ChatGPT has forgotten that it needs to prefix
properties with their type, e.g., email. After pointing
out the mistake ChatGPT responds with the following
query that can be executed in Hansken and delivers valid
results:
type:email email.hasAttachment:true
email.sentOn:2022-07-0
ChatGPT responds as follows: [email.from,email.to,email.cc,email.bcc]:*Quan*
This is a valid HQL query that searches email fields from, to, cc, bcc for occurences of *Quan*. We note that this syntax is not provided in the Hansken HQL manual but it is present as an example in the HQL cheat sheet. 5.2. Summarize, evaluate and visualize chat messages The previous experiment showed that ChatGPT can assist with writing HQL queries. The next logical step is to test if ChatGPT can process the results from a query. In this experiment we ask ChatGPT to assist us with analysing chat conversations that have been extracted from multiple phones belonging to diferent suspects and/or witnesses in an investigation.
At the start of an investigation, very little is known (e.g., only the name of a suspect and a suspicion of a crime). Using contacts in a phone and laptop, an investigator can gain insight into the suspect’s network, certain events, and locations linked to date and time. Digging out all that information is time-consuming and doesn’t always lead to relevant information. ChatGPT can summarize and organize transcripts of chats. Then ChatGPT can also answer questions.
We manually copied 12 chat conversations (a chronologically ordered list of chat messages between two persons) from the Crystal Clear training case6. Initially we presented all chats in a single prompt to ChatGPT but that exceeded the capacity of the current version of ChatGPT. Then, we split the conversations over two and three ifles respectively. In both cases it was dificult to get summaries that were consistent. We then decided to present the chat conversations separately, i.e., as single prompts, but in the same ChatGPT session. Here is the initial prompt asking ChatGPT to summarize a chat between two persons as well as the first conversation: You are SleuthGPT. You are a detective that needs to find out what has been going on in a group of people. They want to help you and gave transcripts of their conversations. Most of them via whatsapp and some of them via Telegram and SMS text messages. You study the conversations and as a sleuth it is your job to figure out who is the leader of the group, who is the buyer, who is transporting and who are helping. It would be helpful if you identify the relationship between persons and if they are friendly, close, if they like each other or not. Dates are in dd-mm-yyyy format. For example 5-7-2022 is July 5th 2022. A name may have a identifier associated. This identifier is shown at the start of the conversion between brackets () following the name if it occurs for the first time. Summarize the following conversation including names of persons communicating, date of first message, date of last message and a summary including a sentiment analysis and characterization of the conversation. 6The Crystal Clear case is a ficticious case that was prepared by the
Person Quan Figo Sheila Summary: Quan and Figo discuss meeting up and sharing information. Quan seems satisfied with the current information and thanks Figo. Quan inquires about the fee for the party, and Figo directs Quan to check their email. Later, Figo provides instructions for Quan regarding a family visit, including purchasing a suitcase for transfer, taking photos of the suitcase and drugs /lab, and setting up a Signal account.
Sentiment Analysis: Participants Quan, Figo Quan, Sheila Quan, Joseph Joseph, Quan
Dates 5-11/7/2022 5-8/7/2022 12-21/7/2022 21/7/2022
Summary Meeting coordination and info sharing. Party fee, family visit instructions.
Discuss daily activities, cofee, dinner, college, clubbing.
McDonald’s and Club Thouma invites.
Coordinate airport pickup, meet at large AKO store.
Coordinate airport pickup, meet at large AKO store.
Joseph, Nerijus 13-18/7/2022
Boxing gala tickets, Gervonta Davis vs. Artur Beterbiev. Joseph, Nerijus
11-20/7/2022 Joseph, Liss
4-22/7/2022 Nerijus, Antonio
5-25/7/2022 Nerijus, Joseph
11-20/7/2022 Nerijus, Rosie
4-22/7/2022 Nerijus, Liss Nerijus, Quan Next we present the remaining 11 chat conversations one by one, but in the same ChatGPT session. After 8 conversations we had to remind ChatGPT of the format by prefixing the following prompt on chat conversation number 9: Summarize the following conversation including names of persons communicating, date of first message, date of last message and a summary including a sentiment analysis and characterization of the conversation.
We concatenate the summaries for all chat conversations in a single text that we refer to as the combined summaries. Using the combined summaries, we perform three more experiments that illustrate how ChatGPT can be used to further evaluate and visualise chat conversations. 5.2.1. List the persons and describe their roles In the first experiment we ask ChatGPT who are involved in the conversations and about their role. We create a prompt by prefixing the combined summaries with the following sentence: Here is a document containing multiple conversations. Create a table with a row for each person involved in these conversations and describe their role.
ChatGPT responds with the information in a tabular layout. Since ChatGPT “understands” how to produce LATEX code, we asked it to present the table in LATEX by prompting “Can you format this as a Latex table?”. This results in Table 1. 5.2.2. Summarize the conversations in a table
table that summarizes the chat conversations. We do this by prefixing the combined summaries (same as before) with the following instruction and using that as a prompt: Here is a document containing multiple conversations. Create a Latex table showing participants, dates, summary in max 15 words, sentiment in max 5 words and characterization in max 5 words.
The result is presented in Table 2. ChatGPT shortened the summaries according to the instructions. Overall, the entries in the table are accurate and informative for someone that wants to get an overview of what the conversations are about. 5.2.3. Visualize interactions between persons As a final experiment, we ask ChatGPT to produce a diagram depicting the social network of the group in
was inspired by a paper from Microsoft Research [33] in which many early experiments with GPT-4 are reported.
We split this experiment into two smaller tasks so that we can keep more control. In the first task, we present the following prompt plus the combined summaries to ChatGPT: Here is a document containing multiple conversations. List all names as nodes. List conversations as connections between nodes. Label connections with the topic of the conversation including an emoticon to reflect the sentiment of conversation. Avoid duplicate topics.
ChatGPT presents two tables. The first table contains the nodes, see Table 3. connection text as labels that run along the edges. Use fixed size small circles with gray color and black contour to depict the nodes. Can you define a separate style for the edges and reference this in the draw sections. Use a smaller font for the edge labels. Arrange the nodes so that edges are not crossing.
The code for the TikZ diagram that is produced by ChatGPT is illustrated in Figure 4 below. Note that to get this particular layout it was necessary to provide additional prompts to get the end result.
The other table containing connections is presented in Table 4. We note that ChatGPT managed to provide emoticons for the sentiment description that is included in the combined summaries. We then instruct ChatGPT to use fontawsome5 to translate the emoticons in the
the following text concatenated with the HTML versions of Tables 3 and 4: Format the following information using TikZ in a Latex figure.
Use the fontawesome5 package for the emoticons. Use the Liss . ceeadn if trseaadnh T
Relationship conflict and divorce É If ChatGPT can assist with writing structured queries and is able to summarize, evaluate and visualize chat messages, the next interesting question is if ChatGPT can analyse results from multiple search queries accross diferent types of evidence. In this experiment we ask ChatGPT to assist us with analysing and cross referencing search results containing browser history, chats and locations from a single device.
We start with introducing the Crystal Clear case to ChatGPT. The prompt also instructs ChatGPT it should act as a sleuth and asks to analyse browser history url’s containing the word ’search’ that are found on the phone from Quan (HQL’type:browserHistory search’).
Quan is one of the suspects in this case. We only include the first three browser history entries but in total there are 50 unique url’s.
You are SleuthGPT. You are a detective that is investigating a case. Quan and Joseph were arrested on July 24, 2022 because they were carrying a large sum of cash money. Quan's Motorolo phone and Josephs iPhone 6s were seized as well as the MacBook from Joseph. These devices have been loaded in Hansken and digital traces have been extracted. Here is the browserhistory from Quan's phone. Can you summarize his internet activity including dates and try to understand his motive and possible activities related to money he was carrying with Joseph?
ChatGPT replies with the following analysis: Based on Quan's browser history, here's a summary of his internet activity: Based on this information, it seems that Quan might be involved in gambling activities, as he searched for a gambling WhatsApp group and information about gambling addiction. He also showed interest in drug smuggling and trafficking, possibly researching the risks and potential punishments involved. Quan's searches about London City Airport, flights from Amsterdam to London, and London's transportation system indicate that he could have been planning a trip to London, which may be related to the large sum of cash he was carrying with Joseph when they were arrested.
The conversations with Sheila (+31685197340) and Joseph (31647730075@s.whatsapp.net) seem to be more casual and focused on social activities, such as going to McDonald's, visiting a club, and meeting family members in Germany.
However, the conversation with Joseph does mention Quan's flight details and airport meet-ups, which could be relevant to the investigation.
The connection between the chats and the browser history is not only in the topics discussed but also in the dates. The conversation with Figo about the suitcase and drugs takes place on 5-7-2022, while the browser history shows searches related to transferring money and drug production on 6-7-2022.
This suggests that Quan may have been researching these topics after discussing them with Figo.
From the previous subsection we know that ChatGPT can summarize chat messages. We now see that ChatGPT can also relate such chat messages to the topics and dates of Quan’s browser history and is able to note that Quan searches on July 6th occurred after his conversation with Figo on July 5th.
Next we present ChatGPT with GPS location traces (HQL’gps.latlong:*’). There are in total 20 pictures that contain GPS traces. The prompt looks as follows (showing only the first three lines): We found the following gps locations on Quan's phone. Can you give a summary of the locations and dates Quan has been assuming that he took the pictures. Can you interpret the geo location and give a name in stead? Is there any relation to activities mentioned in the browser history and chats that you found earlier? "name","gps.createdOn","gps.latlong","gps.misc","gpsLog. application","gps.application" "IMG_20220715_072808635_HDR.jpg","2022-07-15T07:28:09.274Z ","+52.30876+004.76278","","","" "IMG_20220715_072847128_HDR.jpg","2022-07-15T07:28:47.824Z ","+52.30864+004.76151","","","" ...
We note that ChatGPT “understands” the dates in the input and automatically groups searches per date. At the and the reply from ChatGPT is: end ChatGPT tries to infer how these searches may be related to the large sum of cash he was carrying.
Next we take chat conversations that were extracted from Quan’s phone and present these with the following prompt (only listing the first three lines of the first conversion, there are 3 conversations in total).
Based on the GPS coordinates found in the images, here is a
summary of the locations and dates Quan has been:
IMG_20220715_072808635_HDR.jpg: 52.30876, 4.76278 IMG_20220715_072847128_HDR.jpg: 52.30864, 4.76151 Here is a summary of chats that we found on Quan's phone. Does this give you a better idea of what Quan has been doing. Do you see a connection between the chats and the browser history both in topic as well as date times? Conversation 1 between Quan (owner) and Figo (31644891202@s. whatsapp.net): 5-7-2022 12:08:53 - 31644891202@s.whatsapp.net: Hi Quan, do you want to meet again or do you have enough information? 5-7-2022 12:09:22 - owner: i know enough! 5-7-2022 12:09:31 - 31644891202@s.whatsapp.net: Excellent ...
ChatGPT replies as follows: Based on the chats found on Quan's phone, it appears that Quan may have been involved in some potentially illegal activities.
The conversations with Figo (31644891202@s.whatsapp.net) mention buying a suitcase for a transfer, paying cash to leave no traceable receipt, and sending photos of drugs and a lab via Snapchat. These activities could be related to the browser history, particularly the searches on transferring money and drug production. 2. 2022-07-21: Two locations in Amsterdam, Netherlands, near the intersection of Parnassusweg and Gustav Mahlerlaan.
IMG_20220721_094819167_HDR.jpg: 52.30436, 4.75076
IMG_20220721_092831675.jpg: 52.30995, 4.76099 3. 2022-07-09: One location in Amstelveen, Netherlands, near the intersection of Keizer Karelweg and Graaf Aelbrechtlaan.
IMG_20220709_132100583_HDR.jpg: 52.25898, 4.55369
IMG_20220709_132021308_HDR.jpg: 52.25897, 4.5537
IMG_20220709_132058716_HDR.jpg: 52.25898, 4.55369 These locations do not show a direct connection to the browser history and chats, but they provide a general idea of Quan's movements during that time period. The images were taken in Amsterdam and Amstelveen, which are in the Netherlands. The chat with Sheila (+31685197340) on 7-7-2022 mentioned going to Club Thouma, which could be located in or around Amsterdam.
The conversation with Joseph (31647730075@s.whatsapp.net) on 21-7-2022 mentioned meeting at the airport, which could be Amsterdam Airport Schiphol (also in the Netherlands). However, these connections are speculative and would require further investigation to confirm.
Interestingly, ChatGPT “understands” that .jpg refers evidence which can be very helpful when searching for to pictures, can translate GPS locations to places and digital evidence. associates with Amsterdam Airport Schiphol while the name Schiphol is not mentioned in the prompts that we provided. ChatGPT knows that Joseph and Quan talked about meeting at the airport and suggests this could be Schiphol because pictures have been taken in Amstelveen which is close to Schiphol. ChatGPT also states that this connection is speculative and does require further investigation.
Finally we ask ChatGPT to analyse the browser history, chats, locations including date times as a whole with the following prompt. Note that we added the fact that Quan and Joseph were arrested and carried a large sum of cash money. We did this to keep ChatGPT focused on the investigation: Can you analyse the date times, locations, chats and browserhistory and suggest any relations between them? As a sleutgpt, what do these facts tell you about suspect Quan and if he has been involved in illicit activities? Remember that Quan and Joseph were arrested on July 24, 2022 because they were carrying a large sum of cash money.
This results in the following response from ChatGPT:
Based on the available information from the date times,
locations, chats, and browser history, we can attempt to
establish some possible connections and speculate about Quan's
potential involvement in illicit activities. However, these
connections are not definitive proof and would require further
investigation.
1. On July 7, 2022, Quan had a chat with Sheila discussing
going to Club Thouma. The location of this club is not
specified, but it could be in or around Amsterdam, considering
Quan's GPS coordinates from July 9, 15, and 21 are all in the
Amsterdam area. However, there is no direct evidence
connecting Quan's visit to the club with any illicit
activities.
2. On July 2
While the available data hints at the possibility of Quan being involved in illicit activities, it is important to note that these connections are speculative and not conclusive evidence. Further investigation would be required to determine if Quan and Joseph were engaged in illegal activities, and if so, the nature of those activities.
This response provides an accurate representation of the information that was presented to ChatGPT. It appears that ChatGPT is able to cross reference diferent types of
The experiments reflect ChatGPT’s potential in assisting investigators with digital evidence analysis. ChatGPT can interact with Hansken through a well defined and rich query language that is related to a digital trace model. However, limitations such as hallucinations, increased size requirements, and the need for larger context storage are present. Augmented Language Models (ALMs) ofer a solution to these issues, improving LLMs’ performance in digital forensics tasks [34].
ALMs combine LLMs with additional components, such as external tools and reasoning strategies, to enhance their efectiveness [ 35]. They can access more relevant context or information, providing more accurate results in tasks like converting natural language queries into structured queries or summarizing chat conversations. ALMs can also use external tools to augment their current context, improving their performance in complex tasks like reverse engineering obfuscated JavaScript [36].
Autonomous agents like BabyAGI, Auto-GPT, and HuggingGPT leverage GPT-4’s capabilities, ofering a new dimension for digital forensics investigations [37, 38, 39]. These agents use ChatGPT to create a strategic plan which they will execute autonomously (e.g., search the internet, and write/debug code, streamlining investigative tasks and allowing investigators to focus on more critical aspects of a case).
Visual foundation models (VFMs) represent a significant advancement in AI, integrating multimodal inputs (text and images) and generating text-based outputs [40, 14, 41]. GPT-4’s multimodal capabilities are not yet available in ChatGPT but once they are they will be a great addition for digital forensic tools, enhancing AI-assisted analysis of multi-modal data, including text, images, voice and video.
In summary, ALMs, autonomous agents, and GPT-4’s multimodal capabilities each hold significant potential for enhancing digital forensics. They can eficiently manage tasks, search for information, generate new agents, and incorporate external tools and reasoning strategies, providing invaluable support to digital forensic experts. However, in addition to technical experiments as described in this paper it will also be necessary to evaluate user experiences and establish objectively if investigators become more efective in real investigations that contain much more data and thus also much more irrelevant traces.
[4] Y. LeCun, Y. Bengio, G. Hinton, Deep learning,
Nature 521 (2015) 436–444.
ChatGPTs’ adaptability to the Hansken trace model and [5] T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaquery language, strengthened by similar experiments in plan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sasrelated work, suggest it can be applied to a wide range try, A. Askell, et al., Language models are few-shot of databases and systems used in digital investigations. learners, Advances in Neural Information Process
ChatGPT into digital forensic tools has the potential to [6] G. Franceschelli, M. Musolesi, On the creativity of enhance investigators’ capabilities, ultimately contribut- large language models, 2023. arXiv:2304.00008. ing to more efective legal outcomes. [7] J. Roach, Microsoft outlines framework for building
However, ChatGPT’s fine-tuning to be "helpful, honest, ai apps and copilots, 2023. https://news.microsoft.c and harmless" can limit its efectiveness when analyzing om/source/features/ai/microsoft-outlines-frame conversations between criminals. Additionally, providing work-for-building-ai-apps-and-copilots-expands manuals, trace model types, and HQL examples alone -ai-plugin-ecosystem/ (Accessed on June 1, 2023). is insuficient; it is crucial to correct ChatGPT when it [8] P. Vaithilingam, T. Zhang, E. L. Glassman, Expecmakes mistakes, sometimes requiring a trained digital tation vs. experience: Evaluating the usability of forensic expert’s input. code generation tools powered by large language
ChatGPT is not yet the ideal sleuth for digital evidence models, CHI EA ’22, 2022, pp. 1–7. doi:10.1145/ analysis, but LLMs can be invaluable. A SleuthGPT model 3491101.3519665. could be trained by fine-tuning the original GPT-4 model [9] B. Farrukh, Gpt-4: Openai’s game-changing ai adon a dataset specifically focused on investigative and vancement, 2023. Available at: https://medium.c detective work, enabling it to generate more informed om/ai-in-plain-english/gpt-4-openais-game-cha and accurate responses about investigative processes and nging-ai-advancement-18eed5a9aa49, Accessed: techniques [14]. 2023-04-14.
Future research will explore the synergistic application [10] C. Lamanna, Introducing microsoft dynamics 365 of these technologies in digital evidence investigations, copilot, 2023. Available at: https://blogs.microsoft. such as providing examples to ChatGPT on how to inter- com/blog/2023/03/06/introducing-microsoft-dyn act with the Hansken REST API and automatically pro- amics-365-copilot/, Accessed: 2023-04-14. cess the outcome of queries. By combining the strengths [11] W. Zhu, H. Liu, Q. Dong, J. Xu, L. Kong, J. Chen, of ALMs, autonomous agents, and GPT-4’s multimodal L. Li, S. Huang, Multilingual machine translation capabilities, we aim to develop a digital forensics copilot, with large language models: Empirical results and which includes comprehensive AI-assisted tools capable analysis, 2023. arXiv:2304.04675. of processing multi-modal data and addressing diverse [12] T. Zhang, F. Ladhak, E. Durmus, P. Liang, K. McKchallenges faced in investigating digital evidence. eown, T. B. Hashimoto, Benchmarking large language models for news summarization, 2023.
Acknowledgments arXiv:2301.13848. [13] M. Mohney, How chatgpt could impact law and The authors thank Edwin Rijgersberg from the Foren- legal services delivery, Northwestern Engineering sic Big Data Analysis team of the NFI for his valuable News (2023). Available at: https://www.mccormick. comments on earlier versions of this paper. northwestern.edu/news/articles/2023/01/how-cha tgpt-could-impact-law-and-legal-services-deliver y/. Accessed: 2023-05-01.
References [14] OpenAI, Gpt-4 technical report, 2023. arXiv:2303.08774. [1] Y. Liu, T. Han, S. Ma, J. Zhang, Y. Yang, J. Tian, H. He, [15] D. C. Weiss, Latest version of chatgpt aces bar exam A. Li, M. He, Z. Liu, Z. Wu, D. Zhu, X. Li, N. Qiang, with score nearing 90th percentile, ABA Journal D. Shen, T. Liu, B. Ge, Summary of chatgpt/gpt-4 (2023). Available at https://www.abajournal.com research and perspective towards the future of large /web/article/latest-version-of-chatgpt-aces-the-b language models, 2023. arXiv:2304.01852. ar-exam-with-score-in-90th-percentile Accessed: [2] E. M. Bender, T. Gebru, A. McMillan-Major, 2023-05-01.
S. Shmitchell, On the dangers of stochastic par- [16] H. Henseler, Network-based filtering for large email rots: Can language models be too big?, 2021, p. collections in e-discovery, Artificial Intelligence 610–623. doi:10.1145/3442188.3445922. and Law 18 (2010) 413–430. doi:10.1007/s10506 [3] M. Shanahan, Talking about large language models, -010-9099-3.
2023. arXiv:2212.03551. [17] D. van Dijk, D. Graus, Z. Ren, H. Henseler, M. de Ri