Shrinking the digital evidence haystack
By Brandon Epstein
This article is part of AI in Digital Forensics, a blog series exploring the impact AI is having in the world of digital investigations.
Key insights
- The surge in digital evidence means human-only review is no longer viable.
- AI can help investigators focus on verification and analysis.
- Using AI can alleviate burnout and stress and reduce backlogs.
The proliferation of digital data and connected devices has had a profound impact on forensic investigations, straining laboratory resources, pressuring budget-conscious jurisdictions to spend more on technology, and worsening evidence backlogs.
There is a very real human cost, too. For investigators, the need to download and sift through ever-growing stacks of digital evidence exacerbates burnout and affects psychological wellbeing. For victims, backlogs can increase the risk that their offender will go free because evidence couldn’t be analyzed in a reasonable timeframe.
In the face of this digital tsunami, artificial intelligence offers more than just a lifeline. It’s an indispensable element of any modern investigation. That’s because it empowers the investigator to spend more time analyzing and contextualizing evidence rather than spending hours surfacing it.
Human-only review is no longer viable
90% of all criminal cases have a digital element (Source: The U.K. National Police Chiefs’ Council’s Digital Forensic Science Strategy)
Smartphones. Wearables. Social media apps. Police bodycam footage. Encrypted messaging. With the widespread use of these and other technologies, forensic experts are often contending with terabytes of data as they work to identify and then authenticate evidence in a single case.
That’s as criminals continue to exploit new technologies, including AI, to scale or conceal their activities.
Digital forensic investigators can feel like they’re searching for the proverbial needle in a haystack, only that haystack just keeps getting bigger.
The fallout? In Colorado, state lawmakers are grappling with how to deal with the rising volume of digital evidence. A top prosecutor in the state says the amount of video footage her office has to review has almost doubled in just three years. In Tennessee, the average digital forensic lab turnaround time stretches to 66 weeks for computer cases, far exceeding an internal goal of 8-12 weeks that the state has set for all evidence. Many countries report staffing shortages for digital forensic specialists.
Those pressures are echoed in enterprise environments. In the 2026 State of Enterprise DFIR report nearly three quarters of respondents said they’re struggling to recruit and retain skilled DFIR professionals—at the same time as the average number of tools in an investigation has climbed from 5.5 to 7.1 in a single year. More data, more tools, and fewer people is a recipe for backlogs and burnout if teams can’t find smarter ways to work.
AI can create significant investigative efficiencies
That’s where AI’s benefits are clear. AI can surface more relevant data, more quickly, than a human can, as well as detect patterns in large datasets that would strain human capabilities. In performing a triage function, AI enables investigators to spend more of their time evaluating the evidence and making critical decisions about whether to pursue, or discount, investigative leads.
Consider child sexual abuse material (CSAM), a major challenge for law enforcement. Thorn, a U.S. non-profit that partners with law enforcement agencies to improve child safety online, is using AI to speed up identification of victims, stop re-victimization, and flag early signs of abuse before it’s occurred.
104 million 450,000
2023 2004
Images and videos of suspected child sexual abuse in the U.S. (Source: Thorn)
“AI is kind of like the digital accomplice for bad guys because it’s scaling their ability to commit more crime. AI has the potential to be a virtual partner for law enforcement, giving them more context about imagery and potentially what actions to take.”
Brian Herrick, Vice-President of Victim Identification at Thorn
AI’s role: helping to shrink the haystack
AI has the ability to surface investigative leads and reduce workloads, making a significant part of investigators’ work faster and easier. We view AI as akin to a pointer that tells you where in the haystack the needle may be. It’s still incumbent on the investigator to verify that lead.
What AI is not being used for: replacing the human decision-making about if and how the evidence will be used.
We’ll say more about how AI can supercharge the review process in another article.
Brandon Epstein, Technical Forensics Specialist at Magnet Forensics, is a former police detective and co-founder of Medex Forensics, which Magnet acquired in 2024. Brandon specializes in AI and media authentication and is active in many digital forensic community organizations.
Watch Brandon Epstein’s AI Unpacked webinar series on how responsible AI is shaping the future of digital forensics.