Evidence Hub

Hypothesis‑Driven Forensic Email Analysis With Retrieval-Augmented Generation

Ali Loloee Jahromi

AMS Degree Thesis (University of Bologna), 2026

Abstract

This thesis investigates hypothesis-driven forensic email analysis, where investigators begin with a natural-language hypothesis and seek emails that support or contextualize it. A retrieval-augmented generation pipeline is designed and evaluated on three 100-email hypothesis-specific subsets derived from the TREC Legal Track Enron collection. The system preprocesses and chunks emails, expands each hypothesis into sparse and dense queries, and retrieves candidate evidence using BM25, dense retrieval, and reciprocal-rank-fusion hybrid retrieval. Retrieved chunks are aggregated at the email level and analyzed by a large language model, which predicts usefulness, extracts evidence spans, and generates explanations. The evaluation considers retrieval precision, recall, and F1, end-to-end usefulness classification, evidence-span faithfulness and supportiveness, reasoning relevance, correctness and clarity, context enrichment, and multi-run stability. Results show that no single retriever is optimal for every hypothesis: BM25 is strongest when evidence contains explicit lexical cues, dense retrieval is more competitive for semantically indirect evidence, and hybrid retrieval is most useful when sparse and dense signals are complementary. The inference stage substantially improves precision, while retrieval remains the main bottleneck. Evidence spans are generally faithful and explanations are mostly relevant and clear, although weak context can lead to over- or…

Read the paper

Related studies

Go deeper in Evidence Hub

Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.

Open this study Sign up free