Forensic Science International: Digital Investigation 48 (2024) 301675 Available online 26 January 2024 2666-2817/© 2023 The Authors. Published by Elsevier Ltd. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/). A comprehensive analysis of the role of artifcial intelligence and machine learning in modern digital forensics and incident response Dipo Dunsin a, * , Mohamed C. Ghanem a, b , Karim Ouazzane a , Vassil Vassilev a a Cyber Security Research Centre, London Metropolitan University, London, N7 8DB, UK b Department of Computer Sciences, University of Liverpool, Liverpool L69 3BX, UK A R T I C L E INFO Keywords: Data collection and recovery Cybercrime investigation Artifcial intelligence Rule-based reasoning Pattern recognition Genetic algorithms Memetic algorithms Big data analysis Machine learning Chain of custody Volatile memory Digital forensic Cyber incident DFIR ABSTRACT In the dynamic landscape of digital forensics, the integration of Artifcial Intelligence (AI) and Machine Learning (ML) stands as a transformative technology, poised to amplify the effciency and precision of digital forensics investigations. However, the use of ML and AI in digital forensics is still in its nascent stages. As a result, this paper gives a thorough and in-depth analysis that goes beyond a simple survey and review. The goal is to look closely at how AI and ML techniques are used in digital forensics and incident response. This research explores cutting-edge research initiatives that cross domains such as data collection and recovery, the intricate recon- struction of cybercrime timelines, robust big data analysis, pattern recognition, safeguarding the chain of cus- tody, and orchestrating responsive strategies to hacking incidents. This endeavour digs far beneath the surface to unearth the intricate ways AI-driven methodologies are shaping these crucial facets of digital forensics practice. While the promise of AI in digital forensics is evident, the challenges arising from increasing database sizes and evolving criminal tactics necessitate ongoing collaborative research and refnement within the digital forensics profession. This study examines the contributions, limitations, and gaps in the existing research, shedding light on the potential and limitations of AI and ML techniques. By exploring these different research areas, we highlight the critical need for strategic planning, continual research, and development to unlock AI’s full po- tential in digital forensics and incident response. Ultimately, this paper underscores the signifcance of AI and ML integration in digital forensics, offering insights into their benefts, drawbacks, and broader implications for tackling modern cyber threats. 1. Introduction In recent years, the feld of digital forensics has expanded rapidly, relying on technology to collect and analyse digital evidence during criminal investigations, in accordance with Walker (2001). As the use of digital evidence in criminal investigations continues to rise, there is a greater need for effcient and effective crime investigation strategies. Machine learning (ML) and artifcial intelligence (AI) are two potent technologies that have the potential to revolutionise digital forensics by enabling analysts to process vast amounts of data swiftly and precisely, thereby detecting crucial evidence, as stated by Du et al. (2020). This research paper will begin by providing an overview of the feld of digital forensics and the challenges that digital forensic analysts face, including the sheer volume of data, the variety of digital devices, and the dynamic nature of the digital world. The paper will then examine the current use of AI and ML in digital forensics and the obstacles it encounters, such as the lack of standardisation and interpretability is- sues. Also, this paper will explore several ways in which AI and ML can be utilised to improve the effciency and accuracy of digital forensic analysis based on image and text analysis, network analysis, and machine-assisted decision-making. Lastly, the challenges and limitations of using AI and ML in digital forensics will be discussed, as well as po- tential future research directions, discussions, and fndings. The use of digital forensics in criminal investigations has emerged as a burgeoning area of interest. This new feld requires intensive computing to acquire, process, and analyse enormous quantities of data, making the process laborious and time-consuming. To address this challenge, Dunsin et al. (2022) propose a variety of applications and the implementation of artifcial intelligence (AI), such as how AI techniques can be applied in the feld of disaster response (DF) and in the context of incident response in a constrained environment. Notably, the use of AI in criminal investigations is essential, especially given the increasing * Corresponding author. E-mail address: d.dunsin@londonmet.ac.uk (D. Dunsin). Contents lists available at ScienceDirect Forensic Science International: Digital Investigation journal homepage: www.elsevier.com/locate/fsidi https://doi.org/10.1016/j.fsidi.2023.301675 Received 16 August 2023; Received in revised form 2 December 2023; Accepted 26 December 2023