LOG analysis VIA retrieval-augmented generation in digital forensics: experimental methodology and technical architecture
Abstract
Abstract: This paper proposes an experimental methodology and technical architecture adapted for event logs to automate event timeline reconstruction in digital forensic investigations using Retrieval-Augmented Generation (RAG) technology. Analyzing international experience—including institutional and scientific practices from the USA, Europe, the Russian Federation, China, South Korea, and Japan—the core components of the system architecture (log collection, DFIR-specific chunking, embedding, vector database management, and local LLM deployment) are justified based on scientific literature. The study focuses on forensic artifacts generated by local LLM tools ("forensics for AI"), scenario creation for event reconstruction, and standardized evaluation metrics. Furthermore, the compliance of the proposed methodology with Uzbekistan’s procedural requirements and international standards for evidence admissibility (including the U.S. Daubert standard) is examined.
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.