Digital forensics & seized-media triage (incl. CSAM victim identification)

A single seized phone or cloud account can hold hundreds of thousands of images and videos, and case backlogs in cybercrime units keep growing. Forensic triage tools combine hash matching, image/video classifiers, object detection, face and scene clustering and language models to rank material by relevance, so examiners see the most probative items first and view less harmful content. This is a law-enforcement use under strict legal, evidential and air-gapped-operation constraints; decisions and attribution always stay with trained humans.

Problem & value

• Today: examiners page through thumbnails in forensic suites, apply known-hash lists and manually categorise. Reviewing child sexual abuse material (CSAM) causes documented psychological burden, and backlogs delay both prosecutions and the rescue of victims.
• AI value: (1) hash and near-duplicate matching removes already-known material; (2) classifiers surface previously unseen material for priority review; (3) clustering by scene, object, face or device groups related media so one decision applies to many files; (4) object detection and OCR find weapons, drugs, ID documents and cash in non-CSAM cases (fraud, trafficking, terrorism); (5) chat summarisation and translation speed up reading of messages.
• Evidence of benefit: vendors and units report large reductions in manual review time, but public, independent, peer-reviewed numbers are scarce; measure on your own labelled case data rather than relying on vendor claims.

Variants

• CSAM investigation and victim identification: known-hash matching, new-material classification, series grouping, background/object matching for location leads (specialist units).
• General criminal investigation triage: weapons, drugs, documents, extremist symbols, cash.
• Corporate/internal investigations and e-discovery: policy violations, IP theft; see DOC-021. Only the narrow, lawful corporate variant applies; CSAM handling by non-authorities is restricted by criminal law.
• Border/customs and prosecutors' offices: same tools with different legal bases.
• Not private use. Platforms moderating uploads use VIS-027 instead.

How it works

1. seizure
2. forensic imaging (write-blocked)
3. hash-verified evidence store (air-gapped)
4. extraction & carving (images, video frames, chats, metadata)
5. known-material hash match (cryptographic + perceptual)
6. remove / flag known
7. ML classification, object detection, OCR, ASR on remaining media
8. clustering (near-duplicate, scene, face groups, device/source)
9. priority queue for examiners
10. human review & labelling
11. victim-ID leads to specialist unit / international databases
12. audit-logged report with model version and reviewer decisions

• Hashing: SHA-256 for exact matches; perceptual hashes (e.g. PhotoDNA-class, PDQ) for edited copies. Hash sets (e.g. VICS/Project VIC, national or Europol/Interpol sources) are the highest-precision step.
• Classification: CNN/ViT classifiers trained on legally held, controlled datasets by authorities or vendors; they output category scores, not verdicts. Such training data cannot be freely built or shared.
• VLM add-ons: local vision-language models can caption non-CSAM material, and LLMs summarise and translate chats; use only on-prem, with no external API calls.
• Human-in-the-loop: every classification used in a report is confirmed by an examiner; automated outputs are leads, never evidence on their own.
• Wellbeing features: greyscale/blur defaults, limited exposure, audio muted by default, break timers.

Data preparation

Data here are forensic images of phones, laptops and cloud exports, plus chats, hash sets and case metadata. They live in an evidence store, not in the ERP or on ordinary file shares, and access is tightly restricted. Typical gaps: heterogeneous and partly corrupt file formats, huge volumes with many duplicates, encrypted containers, missing case metadata, and mixed languages in chats. There is no labelling backlog in the usual sense, because labelled training material may only be held by authorised bodies.

Preparation steps: write-blocked imaging and hash verification, extraction and carving of media and chats, removal of known material via cryptographic and perceptual hashes, deduplication, OCR of documents and speech-to-text for audio (see DOC-014, DOC-018), and a consistent case metadata schema. Keep a documented chain of custody for every transformation. Build a small, expert-labelled test set to measure the tool locally (PREP-018), and capture examiner corrections as feedback (PREP-021). Check the legal basis and retention for reuse of case data (PREP-025); pseudonymise where tools run outside the case unit (PREP-022).

Rough share of effort: about half of the project goes into ingest pipelines, storage, access rights and evaluation, the rest into tool configuration and training.

Implementation paths

Which path for whom

• Public (police, prosecutors): Path A, because certified forensic suites with legally controlled classifiers and hash-set access are the only practical route; the training material cannot be built or shared freely.
• Enterprise (corporate investigations, e-discovery, forensic service providers): Path C, because seized or employee data is highly sensitive and must stay on-prem; hash matching, OCR, ASR and local VLMs run in an isolated lab.
• Developer: Path C, because open components (hashing, OCR, Whisper, embeddings, local VLMs) can be assembled into triage tooling without sending evidence to external APIs; CSAM classifiers themselves remain restricted to authorised bodies.

Path A — Buy (recommended for authorities)

• Forensic suites: Magnet Forensics (AXIOM, with Magnet.AI), Cellebrite (Pathfinder, Physical Analyzer, Guardian), MSAB XRY, Oxygen Forensics, Belkasoft X, Cyacomp (EU) and Griffeye (now part of Magnet Forensics) for large-scale media analytics, with Project VIC integration.
• EU/European vendors: MSAB (Sweden), Belkasoft, Cyacomp and national in-house developments; also NGO-linked tools such as Thorn's Safer (hash and classifier services, for platforms rather than seized-media forensics).
• Choose A when: you need court-accepted tooling, vendor validation reports, support and hash-database integration. Insist on on-prem/offline deployment and documented model validation.
• Example public-sector programmes: German state-level projects (North Rhine-Westphalia's cybercrime centre ZAC NRW cooperating with Microsoft on AI-assisted CSAM triage) show the typical model: authority-run, on-prem processing with strict legal oversight.

Path B — Build on cloud APIs

Largely not suitable: uploading seized material to external AI services breaches confidentiality, evidence integrity and criminal-law rules, and cloud-hosted CSAM handling is unlawful for non-authorities. Cloud may serve only non-sensitive supporting work (e.g. training analysts, synthetic test data).

Path C — Self-host (open source)

• Building blocks: open-weight VLMs (Qwen-VL family, Gemma, Mistral/Pixtral class) for non-CSAM captioning, OpenCLIP/SigLIP embeddings for similarity search, YOLO/RT-DETR/Grounding DINO for objects, Whisper for audio, InsightFace-class models for face grouping (high-risk, see compliance), Faiss/Qdrant/pgvector for indexes.
• Open forensic frameworks: Autopsy/The Sleuth Kit, plaso, Velociraptor, ssdeep/TLSH fuzzy hashing.
• Hardware: HW3 (48-141 GB GPU) in an air-gapped lab; scale by shards of the evidence set.
• Effort: needs a validation team; no open model replaces vendor-trained CSAM classifiers legally.

Path D — Custom training

Only for authorities with lawful access to controlled datasets (national hash/image repositories), under strict security and ethics approval. Typical work: domain adaptation of generic classifiers, detection of AI-generated imagery, and calibrating thresholds on locally labelled review data. Research groups should use synthetic or non-abusive proxy data and never handle real CSAM without legal authority.

State of the art (2026)

• Hash matching plus classifiers plus clustering is the standard stack; multimodal embeddings now allow "find similar scene/object" search across evidence sets.
• New challenges: AI-generated and manipulated CSAM and deepfakes (need detection and legal handling), end-to-end encrypted apps, huge cloud-extraction volumes, and short-form video.
• Limits: classifiers have false positives (family photos, medical images, art) and false negatives (new styles, low quality); face recognition degrades with age, angle and compression; VLMs hallucinate and must not decide categories. Bias and error rates need local validation.
• Provenance: C2PA/content credentials help for synthetic media but are rarely present on seized devices.

Shared resources & combinations

• Shares image/video classifiers and embedding indexes with VIS-027 (platform moderation) and VIS-031 (video search); face grouping relates to VIS-016; blurring of non-relevant persons in reports uses VIS-030.
• Chat and document analysis shares tools with DOC-021 (eDiscovery), KNOW-016 (archive search) and KNOW-026 (OSINT/link analysis); speaker comparison with SPEECH-010.
• One air-gapped HW3 server can host the whole vision and embedding stack for a unit.

Effort, cost & KPIs

• Path A: licences per examiner/seat plus hardware; weeks to onboard, quarters for validated workflows and training.
• Path C: 6-12+ months for a validated pipeline and dedicated staff.
• KPIs: time from seizure to first victim lead, share of media needing human review, precision/recall per category on a local gold set, backlog size, examiner exposure time, false-positive rate in reports, audit completeness.

People & change

Involve management and the data protection officer first: forensic triage processes special categories of personal data of suspects, victims and third parties, so a DPIA (Art. 35 GDPR) is required, and the legal basis follows police or procedural law rather than consent. IT and information security design the isolated lab and access rights; legal/compliance clears evidentiary use and the AI Act high-risk classification (Annex III duties from 2 Dec 2027). Department leads and examiners should co-design workflows and the pilot.

Works council: depends. Where examiners' tool use is logged, §87(1) no. 6 BetrVG applies (BAG: objective suitability to monitor is enough); in authorities the staff council (Personalrat) under BPersVG or state law is involved. §90(1) no. 3 requires early information about planned AI-supported work processes.

Support AI literacy (AI Act Art. 4): train examiners on score meaning, false positives and automation bias. Pilot with a small team on closed cases and compare against manual triage. Address concerns about job loss and wellbeing openly: the tool reduces exposure through blur and greyscale defaults, and every result stays a lead confirmed by an examiner. See GUIDE-005, GUIDE-004, GUIDE-009.

Risks, regulation & compliance

• EU AI Act: high-risk. Annex III point 6 covers law-enforcement AI such as evaluating the reliability of evidence; Annex III point 1 covers biometric identification, and post-remote biometric identification by law enforcement is subject to specific authorisation under Art. 26(10). Obligations on deployers include human oversight, logging, and FRIA/registration where applicable. Art. 5 prohibitions to avoid: untargeted scraping of facial images to build recognition databases (5(1)(e)), real-time remote biometric identification in public spaces by police outside narrow exceptions (5(1)(h)), and predictive profiling based solely on personality traits (5(1)(d)). Seized-media face grouping must stay within the case's lawful scope.
• Data protection: processing by competent authorities falls under the Law Enforcement Directive (EU) 2016/680 (national laws, e.g. BDSG Part 3 in Germany), not GDPR; special categories and children's data need strict necessity, DPIA and access controls. Corporate variants fall under GDPR.
• Criminal law and procedure: possession and handling of CSAM is a criminal offence except for authorised officials; national rules on evidence admissibility and chain of custody apply (ISO/IEC 27037, 27041-27043 as guidance).
• Mitigations: air-gapped deployment, hash-verified evidence, immutable audit logs, model/version recorded in each report, independent validation, examiner psychological support, red-team tests, no automated adverse decisions.

Getting started

1. Clarify the legal basis, authorisation and data-protection impact assessment with your DPO and prosecutors.
2. Inventory backlog, volumes and current tools; define a local gold-standard test set (with legal approval).
3. Pilot one vendor suite on-prem against the gold set; record precision/recall and review time.
4. Integrate national or Europol/Interpol hash sources and set up audit logging and examiner wellbeing measures.
5. Establish a model-change and revalidation procedure before relying on outputs in court reports.

Sources

1. Regulation (EU) 2024/1689 (AI Act) - https://eur-lex.europa.eu/eli/reg/2024/1689/oj
2. Directive (EU) 2016/680 (Law Enforcement Directive) - https://eur-lex.europa.eu/eli/dir/2016/680/oj
3. Magnet Forensics (AXIOM, Griffeye) - https://www.magnetforensics.com/
4. Cellebrite Pathfinder - https://cellebrite.com/en/pathfinder/
5. Project VIC International (VICS data model) - https://www.projectvic.org/
6. Thorn Safer - https://safer.io/
7. Europol European Cybercrime Centre (EC3) - https://www.europol.europa.eu/about-europol/european-cybercrime-centre-ec3
8. Autopsy / The Sleuth Kit - https://www.sleuthkit.org/autopsy/
9. ISO/IEC 27037 digital evidence guidelines - https://www.iso.org/standard/44381.html