Use of Machine Learning in digital forensics

a proposal for evidence classification

Abstract

The growing complexity of cybercrime and the exponential increase in digital evidence volume challenge traditional digital forensic practices. This article proposes the integration of Machine Learning techniques as a complementary resource for automated triage and classification of files recovered during forensic investigations. The study presents a conceptual model based on supervised algorithms — including Random Forest, Support Vector Machines, and K-Nearest Neighbors — applied to datasets extracted through widely used forensic tools. It details dataset construction procedures, evaluation criteria, and the technical, legal, and ethical requirements for practical adoption within the Brazilian forensic context. As its main contribution, the work systematizes guidelines for the trustworthy use of artificial intelligence in digital forensics, indicating potential gains in efficiency, standardization, and decision-support without replacing human supervision. Therefore, this study constitutes a methodological proposal with scientific and operational implications for the modernization of digital investigations.