From backlogs to breakthroughs: AI’s role in evidence review

By Brandon Epstein

This article is part of AI in Digital Forensics, a blog series exploring the impact AI is having in the world of digital investigations.

Law enforcement agencies around the world are looking at ways in which AI can alleviate some of their biggest pain points. The expanded use of AI in policing generally, and digital forensics more specifically, is still evolving. But it’s already clear that AI can help reduce the investigative challenges created by the tsunami of digital evidence and complexity of that data.

Our view is that AI’s potential goes far beyond reducing investigative backlogs. In fact it holds the potential to fundamentally alter the way we interact with data, supercharging the review process and enhancing our ability to deliver justice at scale.

AI can speed up evidence collection and create investigative efficiencies

The backlog in digital forensics is well documented. Seized devices can spend months awaiting processing.  Once processed, it can take hours or days for an investigator to pore over communications, pictures, chat threads, browsing history, and a litany of other digital evidence to surface leads. And that’s before they have had time to develop a fuller understanding of how this evidence fits into the larger case.

We know that AI algorithms can surface potential leads much more rapidly than a human can, reducing the burden of manually parsing terabytes of data. But AI can also be trained to prioritize the identification of some kinds of information, enabling faster analysis as well.

Even with the efficiencies AI provides, it is still incumbent on the investigator to review any evidence that AI has surfaced to assess its reliability, how it was sourced and how relevant it is to the case.

Using AI will become an equalizer; effective deployment of AI could be a differentiator

Given the growing burden of digital evidence, AI capabilities are  fast becoming a must-have in digital investigations. But deployment alone won’t supercharge the review process — that will only come when investigators view AI as a thought partner in the review process. AI, for example, could point an investigator to explore avenues of investigation not before possible, like identifying long-term contacts or anomalies, or cryptocurrency usage in new ways.

AI’s ability to surface, synthesize and analyze data across large datasets, in ways never before possible, can help investigators identify criminal connections or construct case timelines far more rapidly than would be the case in human-only review. The technology’s ability to rapidly operate across multiple dimensions may help surface previously undetected relationships or patterns.

Future advances in AI may even answer some of the “why” questions previously left to the human examiner. Most likely, it will provide the answers to the easier questions in any case. But that will free up highly skilled examiners to dive more deeply into the more challenging questions that arise in any case.

Building trust in rigorous AI investigation tools will be key to expanded use

AI can automate tasks, but it will never automate trust. The human will always have the ultimate say in deciding which outputs contain demonstrably reliable leads and evidence.

Indeed, the litmus test in expanded use of AI in digital forensics will be whether the investigator is comfortable acknowledging that some of the leads were first surfaced by AI tools. Achieving that comfort level and confidence will require a trusted partnership with tool developers, backed by responsible and reliable development, testing, and published reference material, and supported by user training.

I’ve said it before — AI isn’t a threat to digital forensic investigations. Instead, it presents a significant opportunity to improve on current practices and to better understand error rates, while keeping human beings focused on what matters most: evaluating evidence to ensure justice is served.

Brandon Epstein, Technical Forensics Specialist at Magnet Forensics, is a former police detective and co-founder of Medex Forensics, which Magnet acquired in 2024. Brandon specializes in AI and media authentication and is active in many digital forensic community organizations.

Watch Brandon Epstein’s AI Unpacked webinar series on how responsible AI is shaping the future of digital forensics.