# ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown

arXiv: https://arxiv.org/abs/2307.10195 · HTML: https://mlsanity.com/paper/2307.10195/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 34 references that are in the map.
- First posted on arXiv 10 Jul 2023.

## Builds on (most cited first, 6 of 6)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [GPT-4 Technical Report](https://mlsanity.com/paper/2303.08774/) (2023)
- [XLNet: Generalized Autoregressive Pretraining for Language Understanding](https://mlsanity.com/paper/1906.08237/) (2019)
- [SoK: Exploring the State of the Art and the Future Potential of Artificial Intelligence in Digital Forensic Investigation](https://mlsanity.com/paper/2012.01987/) (2020)
- [EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution](https://mlsanity.com/paper/1704.08990/) (2017)

## Built on by (most cited first, 17 of 17)

- [A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Ugly](https://mlsanity.com/paper/2312.02003/) (2023)
- [When LLMs Meet Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2405.03644/) (2024)
- [Can ChatGPT Detect DeepFakes? A Study of Using Multimodal Large Language Models for Media Forensics](https://mlsanity.com/paper/2403.14077/) (2024)
- [Large Language Models for Cyber Security: A Systematic Literature Review](https://mlsanity.com/paper/2405.04760/) (2024)
- [LGTM: Local-to-Global Text-Driven Human Motion Diffusion Model](https://mlsanity.com/paper/2405.03485/) (2024)
- [Review of Generative AI Methods in Cybersecurity](https://mlsanity.com/paper/2403.08701/) (2024)
- [Exploring the Potential of Large Language Models for Improving Digital Forensic Investigation Efficiency](https://mlsanity.com/paper/2402.19366/) (2024)
- [DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response](https://mlsanity.com/paper/2505.19973/) (2025)
- [Computer Vision for Multimedia Geolocation in Human Trafficking Investigation: A Systematic Literature Review](https://mlsanity.com/paper/2402.15448/) (2024)
- [Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw](https://mlsanity.com/paper/2604.05589/) (2026)
- [Enhancing Reasoning Capacity of SLM using Cognitive Enhancement](https://mlsanity.com/paper/2404.01135/) (2024)
- [Generation of Programmatic Rules for Document Forgery Detection Using Large Language Models](https://mlsanity.com/paper/2512.19228/) (2025)
- [Vision-Language Model Based Handwriting Verification](https://mlsanity.com/paper/2407.21788/) (2024)
- [Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response](https://mlsanity.com/paper/2506.00274/) (2025)
- [Large Language Models in Cybersecurity: Applications, Vulnerabilities, and Defense Techniques](https://mlsanity.com/paper/2507.13629/) (2025)
- [U-Define: Designing User Workflows for Hard and Soft Constraints in LLM-Based Planning](https://mlsanity.com/paper/2605.02765/) (2026)
- [Sample-Efficient LLM-Based Detection of Malicious Web Server Logs with Forensically Explainable Reasoning](https://mlsanity.com/paper/2606.08649/) (2026)

## Abstract (arXiv)

The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.