ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown

John Sheppard, Mark Scanlon, Chris Hargreaves, Frank Breitinger, Jan-Niclas Hilgert

Research output: Contribution to journalArticlepeer-review

13 Citations (Scopus)


The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.
Original languageEnglish (Ireland)
JournalForensic Science International: Digital Investigation
Publication statusPublished - Oct 2023


  • ChatGPT
  • Generative pre-trained transformers (GPT)
  • Large language models (LLM)
  • Digital forensics
  • artificial intelligence


Dive into the research topics of 'ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown'. Together they form a unique fingerprint.

Cite this