AI-Powered Digital Forensics Investigation Platform
A forensics platform that uses LLM classification to analyze unknown SQLite databases, unify artifacts into cross-application timelines, and draft court-ready investigative narratives.
The Problem
Digital forensics investigations drown in unknown data. A seized disk image contains dozens of application databases, and every unfamiliar one traditionally requires days of manual schema reverse-engineering—there is no parser for an app the toolchain has never seen. Evidence that is successfully extracted then sits in silos, forcing investigators to hand-correlate timestamps across messages, locations, browser history, and file activity from separate sources.
The operational side is just as manual: mounting NTFS images and querying databases over SSH for every lookup, no programmatic access for web-based tools, no visibility into hours-long analysis runs without repeatedly checking logs by hand, and growing risk of cross-case contamination as concurrent investigations multiply. Between raw database dumps and a court-ready narrative lies enormous analyst time.
What We Built
We built an automated pipeline from evidence to narrative. The toolkit scans disk images to discover every SQLite database, then a LangChain/GPT-4 classifier analyzes schemas and sample data to determine what application each database belongs to—with confidence scoring, and no predefined parsers required. An artifact extractor normalizes application-specific data into eight standardized behavioral artifact types—messages, locations, web visits, files, contacts, calls, emails, app usage—handling 10+ timestamp formats, and a behavioral analyzer reconstructs unified cross-application timelines. A narrative generator then drafts investigative reports with evidence citations.
Serving the investigation workflow, a Go REST API provides secure programmatic access to databases inside mounted forensic images—scenario-based isolation per case, path validation against directory traversal, Redis-cached queries, and S3 integration for forensic image discovery—while a WebSocket service streams analysis logs live to investigator dashboards over connections stable across 24-hour sessions.
AI classification of unknown databases
LangChain and GPT-4 analyze schema and sample data to identify what application produced a database, replacing days of manual reverse-engineering per unknown source with automated classification and confidence scores.
Unified behavioral artifact model
Disparate application data normalizes into eight standard artifact types with ISO 8601 timestamps and privacy protection rules, making cross-application timeline reconstruction automatic.
Draft narratives with citations
The narrative generator turns extracted timelines into executive summaries and investigative report drafts with evidence citations—reviewable starting points instead of raw dumps.
Secure evidence access and live monitoring
A scenario-isolated REST API replaces manual mounting and SSH queries with validated HTTP calls, while live log streaming lets investigators watch concurrent analysis runs from browser tabs.
How It Works in Practice
An investigator processing a seized laptop image containing databases from applications the team has never encountered.
- 1
Discover and classify
The pipeline scans the mounted image, finds every SQLite database, and the AI classifier identifies each one—including the unfamiliar apps—with confidence scores.
- 2
Extract and normalize
Application data converts into the eight standard artifact types, timestamps unify to ISO 8601, and everything lands in one queryable evidence store.
- 3
Reconstruct the timeline
Messages, locations, web visits, and file activity merge into a single cross-application timeline of behavior—the correlation work that used to consume analyst days.
- 4
Draft the report
The narrative generator produces an investigative draft with evidence citations while live logs stream to the dashboard, and the investigator reviews rather than assembles.
Engineering Approach
LLMs where parsers cannot exist
No toolchain can ship parsers for every app in existence—classification from schema and sample data is the only approach that scales to unknown sources, so it anchors the pipeline.
Normalize early, correlate automatically
Forcing all evidence into one behavioral schema up front is what turns cross-application correlation from expert manual work into a query.
Evidence integrity as an API property
Read-only access, scenario-based isolation, and path validation are enforced by the platform itself, so multi-case operations cannot cross-contaminate evidence by accident.
Have a similar problem?
Tell us what you're working on and we'll tell you honestly whether we can help.
