Abstract: Provided are systems and methods for surfacing relevant forensic data in a digital forensic investigation. A system comprises an investigation module configured to generate an investigation interface, wherein the investigation interface includes a field for selecting a case type from a plurality of case types and wherein upon selection of the case type the investigation interface displays a plurality of case type dependent data input fields for inputting case-relevant information, at least one artificial intelligence (AI) model configured to create at least one algorithm for surfacing and evaluating forensic data based on the case-relevant information, and an evidence module configured to scan at least one target device using the at least one algorithm and acquire relevant forensic data, and generate at least one visualization of the acquired relevant forensic data and at least one visualization of at least one evidence value score for each of the acquired relevant forensic data.

Abstract: Systems and methods for presenting forensic data in a forensic data review user interface and for generating reference hash sets are provided. The method includes receiving a selection via the forensic data review user interface to display a forensic data collection; in response to receiving the selection, hashing at least one forensic data item in the forensic data collection to generate a hash value; determining that the hash value matches a reference hash value in at least one reference hash set; varying a default display property of the at least one forensic data item according to a presentation rule encoded in the reference hash set and associated with the reference hash value to obtain a varied display property; and displaying the forensic data collection in the forensic data review user interface including the at least one forensic data item according to the varied display property.

Abstract: A system and associated method for intelligence gathering is provided. The system includes a forensic data source, an investigation module, and a report generation module. The investigation module is configured to collect subject data of a subject from the forensic data source and transmit subject data to the report generation module. The report generation module is configured to receive the subject data from the investigation module and analyze subject data to generate an investigation report output.

Abstract: Systems and methods for predicting significant files for a digital forensic investigation are provided. A method of predicting files of interest during a digital forensic investigation of a target dataset stored on a target device includes tagging a plurality of significant files from a plurality of previous investigations to create at least one set of predictive criteria, storing the at least one set of predictive criteria in a memory of the investigator device, using a first set of predictive criteria to generate a first executable recommendation engine model, storing the recommendation engine model in the memory of an investigator device, automatically scanning the target dataset by a recommendation engine using the first recommendation engine model, and providing an output of any files of interest.

Abstract: A system and associated method for insider threat prediction. The system includes a forensic data source, a threat prediction module, and a data collection module, wherein the data collection module is configured to collect subject data of a subject from the forensic data source, and transmit the subject data to the threat prediction module, wherein the threat prediction module is configured to receive subject data from the data collection module and analyze subject data to generate an insider threat output characterizing the insider threat level of the subject.