Forging the Evidence: Can AI Generate Valid, Cheat-Proof Forensic Case Scenarios for Every Learner?

Topic Description

Every learner in digital forensics trains on the same small set of hand-built case images: they leak online, they invite collusion, and they take skilled staff days to construct. The problem bites hardest where training is most operationally critical. Police first responders and digital forensics trainee practitioners need evidence material customised to their operational role and uniquely different from the resources they have already worked through, so that the competence they demonstrate is genuinely their own rather than a memory of a shared exercise.

This studentship asks whether generative artificial intelligence can meet both audiences at once: university students, law-enforcement trainees and continuing professional development (CPD) cohorts, by producing, on demand, a unique but equally fair and equally difficult case scenario for every learner, on any storage-based digital device, with each scenario supplied complete with machine-readable ground truth, a test sheet and a mark scheme.

A working proof of concept (DiskForge), developed through prior masters-level research and verified with industry-standard forensic tooling, demonstrates that the engineering is feasible. What remains unproven is the science: whether generated scenarios are forensically valid, whether their difficulty can be calibrated so that uniqueness does not cost fairness, and whether training on them measurably improves investigative performance. Establishing that is the substance of this PhD.

Background and rationale

Forensic education faces a well documented corpus gap. Real seized media carries personal data and is legally undistributable (Garfinkel et al., 2009); synthetic corpora are useful only where generation guarantees realistic properties (Yannikos et al., 2014); and manual scenario creation is too slow to repeat at scale (Moch and Freiling, 2009). A critical review of prior generators — Forensig2 (Moch and Freiling, 2009), ForGe (Visti et al., 2015), EviPlant (Scanlon et al., 2017), SecGen (Schreuders et al., 2017), TraceGen (Du et al., 2021) and recent large-language-model authoring approaches (Voigt et al., 2024), shows many partial solutions and no complete, usable one that generates realistic evidence and the assessment materials that make it directly usable for teaching.

Two audiences share this gap with different stakes. In higher education, a fixed corpus undermines assessment integrity: once an image circulates, every cohort that follows is compromised (Schreuders et al., 2017). In policing, first responders and trainee digital forensic investigators are typically taught on generic or borrowed academic material that does not reflect the devices, warrants or procedures of their operational world; and competencies must be evidenced against professional frameworks such as the European Cybercrime Training and Education Group's Global Cybercrime Certification profiles, developed with law enforcement and universities across 27 EU states (European Cybercrime Training and Education Group, no date). Unique, calibration-controlled scenario generation could serve both: per-learner assessment in the university, and role-specific, uniquely different evidence for police and practitioner training at scale.

The scope is deliberately wider than desktop computers. Evidential material now resides on any storage-based digital device: laptops and workstations, mobile phones and tablets, removable media and memory cards, consumer and industrial Internet of Things devices, and vehicle and drone systems. A generation framework must therefore abstract artefact production beyond a single operating system to a taxonomy of storage devices, a generalisation no prior tool has attempted.

Skills Required

A good first degree (2:1 or above, or equivalent) in computer science, cyber security or digital forensics is required, together with programming competence in Python. Prior experience of digital forensics tooling is welcome but not essential: the successful candidate will be trained in the generation pipeline, forensic examination practice and study design.

Background Reading

Basis Technology (2024) Autopsy digital forensics platform. Built on The Sleuth Kit. Available at: https://www.autopsy.com (Accessed: 6 October 2026).

Du, X., Hargreaves, C., Sheppard, J. and Scanlon, M. (2021) 'TraceGen: user activity emulation for digital forensic test image generation', Forensic Science International: Digital Investigation, 38, 301133. doi: 10.1016/j.fsidi.2021.301133.

European Cybercrime Training and Education Group (no date) Global Cybercrime Certification project kick off meeting. Available at: https://www.ecteg.eu/global-cybercrime-certification-project-kick-off-meeting/ (Accessed: 6 October 2026).

Garfinkel, S., Farrell, P., Roussev, V. and Dinolt, G. (2009) 'Bringing science to digital forensics with standardized forensic corpora', Digital Investigation, 6, pp. S2–S11. doi: 10.1016/j.diin.2009.06.016.

Horsman, G. and Lyle, J.R. (2021) 'Dataset construction challenges for digital forensics', Forensic Science International: Digital Investigation, 38, 301264. doi: 10.1016/j.fsidi.2021.301264.

Moch, C. and Freiling, F.C. (2009) 'The forensic image generator generator (Forensig2)', in 2009 Fifth International Conference on IT Security Incident Management and IT Forensics. IEEE, pp. 78–93. doi: 10.1109/IMF.2009.8.

National Institute of Standards and Technology (2016) The CFReDS project: computer forensic reference data sets. Available at: https://cfreds.nist.gov (Accessed: 6 October 2026).

Palmbach, D. and Breitinger, F. (2020) 'Artifacts for detecting timestamp manipulation in NTFS on Windows and their reliability', Forensic Science International: Digital Investigation, 32, 300920. doi: 10.1016/j.fsidi.2020.300920.

Scanlon, M., Du, X. and Lillis, D. (2017) 'EviPlant: an efficient digital forensic challenge creation, manipulation and distribution solution', Digital Investigation, 20, pp. S29–S36. doi: 10.1016/j.diin.2017.01.010.

Schreuders, Z.C., Shaw, T., Shan-A-Khuda, M., Ravichandran, G., Keighley, J. and Ordean, M. (2017) 'Security scenario generator (SecGen): a framework for generating randomly vulnerable rich-scenario VMs for learning computer security and hosting CTF events', in 2017 USENIX Workshop on Advances in Security Education (ASE 17). Vancouver, BC: USENIX Association.

Visti, H., Tohill, S. and Douglas, P. (2015) 'Automatic creation of computer forensic test images', in Computational Forensics. Lecture Notes in Computer Science, vol. 8915. Cham: Springer, pp. 163–175.

Voigt, L.L., Freiling, F. and Hargreaves, C.J. (2024) 'Re-imagen: generating coherent background activity in synthetic scenario-based forensic datasets using large language models', Forensic Science International: Digital Investigation, 50, 301805. doi: 10.1016/j.fsidi.2024.301805.

Woods, K., Lee, C.A., Garfinkel, S., Dittrich, D., Russell, A. and Kearton, K. (2011) 'Creating realistic corpora for security and forensic education', in Proceedings of the ADFSL Conference on Digital Forensics, Security and Law, pp. 123–134.

Yannikos, Y., Graner, L., Steinebach, M. and Winter, C. (2014) 'Data corpora for digital forensics education and research', in Advances in Digital Forensics X. IFIP Advances in Information and Communication Technology, vol. 433. Berlin: Springer, pp. 309–325. doi: 10.1007/978-3-662-44952-3_21.

Contact