Gains:
- Understanding that collection steps such as volatility order, image acquisition, hash and chain of custody are human responsibility, and artificial intelligence only produces plans and templates here
- Ability to safely use artificial intelligence to accelerate review with file triage, OCR, summary and asset extraction after the image is taken
- Being able to distinguish that triage is not elimination but prioritization, and that sampling from the low-priority group is necessary to avoid the risk of false negatives.
You've arrived at a crime scene: a computer open on the table, an external drive, two phones, and a server room. Every device is a potential source of evidence; Every wrong move is evidence that will be rejected in court. Evidence acquisition is the process of capturing and copying digital evidence intact, verifiable and in accordance with the law. In this unit, you will learn which steps of this process AI can safely assist in and which steps it should definitely stay behind. The critical rule from the beginning: AI does not gather evidence and does not take images; It helps review and expedite the derivation of evidence collected and verified.
Collection order and volatile data
There is a principle of priority in collecting evidence: order of volatility — collection from the most quickly disappearing data to the most permanent. At the top is volatile data — RAM contents lost when the device shuts down, open network connections, running processes; Then comes disk, then external recordings. Volatile data, once lost, does not come back; Therefore, in a running system, RAM is dumped before the disk.
AI does not make decisions at this stage, but is useful in producing checklists and procedure outlines: “What should I collect, in what order, with what tool, what should I document in this scenario?” The collection process itself (write-blocking binding, image acquisition, hash verification, sealing) is in human hands and every step is documented.
Tip: Before you start picking, explain your scenario to the AI and draft a "volatility sequential picking plan"; then compare this draft with your institution's standard procedure (e.g. local legislation and laboratory SOP). AI is reminder, not authority.
Imaging and hashing: inviolable chain
An exact image is taken from each collected device. While the image is being imported, the source is protected by a write blocker; When the image is finished, a hash (SHA-256 is preferred; MD5 alone is now considered weak) is calculated. This hash is the fingerprint of the image: it must be the same at every hash check throughout the examination, otherwise the image is corrupted. Chain of custody form (by whom, when, where the evidence was taken, where it was placed, to whom it was delivered) is updated every time it changes hands.
The AI does two secure jobs here: (1) generates chain of custody and evidence tag templates to be filled out during collection; (2) organizes the hashes and timestamps you collected for a consistency check (“are these three hashes the same, which image belongs to which device?”). The AI does not calculate the hash itself — it makes it a forensic tool; The AI only edits the record.
Review acceleration: The real power of AI
Once the evidence is verified and the image is captured, the AI truly shines. Typical acceleration areas:
- File classification: Grouping tens of thousands of files by type, content and possible relevance and recommending priorities.
- Text and document summary: Subject and party extraction for long contracts, emails, chat transcripts.
- OCR and visual content: Extracting text from scanned documents (OCR — optical character recognition, converting text in an image) and tagging objects/text in images.
- Entity extraction (NER — named entity recognition, finding named entities such as person, institution, account, IP from text): listing person, IBAN, phone, e-mail, crypto wallet address from thousands of documents.
- Code and command description: Explain in plain language what a found script or command history does (to be verified).
In each, the output is a starting point; The decision on relevance and evidentiary value lies with the expert.
Attention: AI saying "this file is irrelevant" is not enough to eliminate that file without examining it. Triage lowers the priority, but in critical cases, sampling is also done from the low-priority cluster. False negatives (omitting real evidence as “irrelevant”) are the most expensive mistake in computer forensics.
three mini cases
Case 1 — Confidential document with OCR. One corruption investigation had 14,000 scanned pages; none of them were searchable text. With AI-powered OCR, all pages were transcribed and searched for patterns such as "offshore", a specific company name and IBAN. 9 critical pages found in 40 minutes; Reading by hand would take weeks. Each page was then expertly verified.
Case 2 — Entity inference relationship network. One fraud file contained 6,200 emails. With NER, all contacts, accounts and phones were extracted and a relationship list was created; Thus, two previously unnoticed brokerage accounts emerged. The AI marked the connection; The prosecutor confirmed the evidence in the emails themselves.
Case 3 — Danger of false negatives. One team wanted to completely eliminate a set of 30,000 files that AI called "low interest." The senior expert randomly sampled 2% from this cluster and found a critical record in it: the AI had misclassified the file because of the unusual extension. Sampling discipline saved the case.
Four copyable templates
1) Draft collection plan:
Your role: crime scene forensic collection specialist. Scenario: [on PC, 2 phones, 1 NAS, running server]. Outline a collection plan for me in order of volatility: what to collect for each device, what tool is recommended, what to document. Please note that this is a draft and requires confirmation according to local legislation.
2) Chain of custody template:
Generate me a chain of custody form template: include evidence number, device description, serial number, collector, date/time, collection method, hash (SHA-256), receiver, deliverer, storage location and lines for each handoff.
3) Bulk file triage request:
I'll give you a list of files (name, size, date, extension). Group by high/medium/low likelihood of forensic interest and write JUSTIFICATION. Note: "low" is not eliminated, it is just prioritized. Mark those with extension-content mismatch separately.
4) Explain the found script:
Explain this script/command history in a forensic context: what does it do, what file/network access does it have, is there any trace of persistence or data exfiltration? Link each assertion to a line in the script. If you are unsure, mark it as "must be verified".
Weak prompt / Strong prompt
Weak prompt:
Separate these files according to the important ones.
"Substantial" is undefined; AI sifts through its own assumptions and may miss critical evidence.
Powerful prompt:
Your role: forensic triage analyst. Context: We are investigating a ransomware incident, encryption and data exfiltration. I will give you a list of files with name, size, creation/modification date and extension. Task: encryption tool, compression/archive, unusual extension, changed in the last 72 hours, and mark large export files as high priority; Write justification for each decision. If the extension does not match the expected content, warn also. Do not say "delete/discard" any file; just prioritize.
The context, target, and the "don't say delete" constraint make the output both useful and safe.
Collection vs. review: AI role chart
Stage
Is AI safe?
AI's job
man's work
Volatile data collection
No (decision)
plan draft
Collection, documentation
image acquisition
no
template
Write blocker, hash
Hash verification
no
record order
Calculation and confirmation via vehicle
File triage
Yes
prioritization
decision, sampling
OCR/text extraction
Yes
conversion
accuracy verification
entity inference
Yes
List generation
Relevance decision
Common mistakes
- Trying to make the AI "do" the picking. AI does not add; It only produces plans and templates. Image and hash are human works.
- Mistaking the triage result as definitive elimination. Don't skip sampling from the "low interest" cluster.
- Quoting OCR output without verifying it. OCR can mix letters (0/0, 1/l); Confirm critical values with source.
- Blindly trusting the extension. The extension may have been changed; Check the content type.
- Uploading personal data to a vehicle without a mask. TC/IBAN/health data may be leaked in bulk inference.
In summary
Evidence collection is a human responsibility: the order of volatility, image, hash and chain of custody are in human hands; Here AI only produces plans and templates. Once the evidence is verified and the image is captured, AI adds real value in speeding up review (triage, OCR, summary, entity extraction, code annotation). But every output is a sign to be verified; The decision on relevance and evidentiary value lies with the expert, who also takes into account the risk of false negatives.
Application task
Describe a fictitious incident scenario (e.g., an employee is suspected of exfiltrating data). First draw a plan with the "Collection plan draft" template and compare it with the local procedure. Then prepare a sample file list of 20 lines and prioritize it with the "Bulk file triage" template; hand sample at least 10% and verify the AI's classification.
checklist
- [ ] I set up the collection plan in order of volatility and compared it with the procedure.
- [ ] I got the image and hash via human/tool; I didn't have it done by AI.
- [ ] I updated the Chain of custody form every time it changed hands.
- [ ] I sampled from the "low" cluster of the triage result.
- [ ] I verified the OCR and asset output with the source; I masked personal data.