AI-DRIVEN FORENSIC ANALYSIS: CORRELATING CYBERSECURITY ARTIFACTS with LLMs and RAG

Digital forensic analysis involves examining diverse evidence sources, including emails, messages, social media, media files, and devices. Manually correlating these artifacts to reconstruct event timelines is time-consuming and error-prone. This research proposes an AI-driven framework that automates artifact correlation using Large Language Models (LLMs), Generative AI (GenAI), and Retrieval-Augmented Generation (RAG) to enable faster, more accurate classification via transformer-based models such as Mixtral, Qwen, Stable Diffusion, and BERT. The RAG component enhances LLM capabilities by retrieving contextually relevant information from case-specific external knowledge repositories or databases, rather than relying solely on the model's internal encoding and decoding. We developed a prototype that ingests and processes data from sources like chat logs, Call Detail Records (CDRs), Internet Protocol Detail Records (IPDRs), and email logs; identifies threats or incidents; and organizes them chronologically. Leveraging RAG for reasoning, analysis, and generation, the system extracts historical or domain-specific data to correlate incidents, visualize entity relationships through interactive mindmaps, and support hypothesis generation for suspects. Evaluated on synthetic forensic mock datasets , the prototype achieved a high correlation accuracy and reduced a substantial time of going through the whole raw data and filtered/flagging the contents .