Quick answer: ChatGPT is not a digital forensics tool. It cannot acquire a forensic image, compute a verifiable hash, maintain chain of custody, or produce reproducible output. It does help with writing scripts, generating regular expressions, summarizing large text and polishing report language. The critical rule is this: the AI output is never the evidence, the verifiable tool output is. Uploading client or corporate data to a cloud AI service is itself a data breach risk.

One of the most common questions reaching forensic labs over the past two years is simple: "Can we do this examination with ChatGPT?" The question sounds harmless, but the answer decides whether your examination survives in court. This article explains where AI genuinely helps in digital evidence work, where it destroys the case, and which uses create direct legal exposure.

The four unchanging rules of digital forensics

To see where AI fits, recall the fundamentals. International guidance such as ISO/IEC 27037 and SWGDE requires four conditions for digital evidence to be admissible:

  1. Integrity. The evidence must be unchanged from the moment of acquisition. A hash value proves this.
  2. Chain of custody. Who touched the evidence, when and why must be recorded without gaps.
  3. Reproducibility. An independent expert applying the same method must reach the same result.
  4. Explainability. The expert must be able to explain in court every step taken.

A large language model satisfies none of these on its own. The model does not compute a file hash, it produces text that looks like a hash. That distinction is where everything begins.

What ChatGPT cannot do in forensics

It cannot collect evidence or acquire images

A forensic copy is taken bit by bit in a write protected environment, using a hardware write blocker together with tools such as FTK Imager, Guymager or dd. A language model has no physical access to a disk. Typing "acquire the disk image" into a chat window starts no technical process at all.

It cannot verify hashes

MD5, SHA1 and SHA256 are deterministic algorithms: the same input always produces the same output. A language model is probabilistic. Ask it for a file's SHA256 and it may return a fabricated string of the correct length and appearance. In forensics that alone is enough to discard the report.

It does not produce reproducible results

Ask the same question twice and you may get different answers. A court expects an independent expert to be able to repeat the method. A black box whose output changes each run does not meet that expectation.

It hallucinates

This is not a theoretical risk but a documented failure. In the 2023 United States case Mata v. Avianca, lawyers filed a brief containing court decisions produced by ChatGPT that did not exist. The court sanctioned the lawyers over the fabricated citations. If the same behavior appears in an expert report, the outcome is not only rejection of the report but loss of the expert's credibility.

The real danger: confidentiality and data protection

More urgent than the technical limits is the legal exposure. When you paste emails, accounting records or a customer list from a case file into a cloud AI service, three things happen at once:

  • Personal data is transferred to a third party. Under data protection law this is a transfer, and cross border transfer rules usually apply. Without a lawful basis, the act itself is a violation.
  • Investigation confidentiality is compromised. Data from an ongoing case leaves systems you control.
  • Privilege and trade secret protection are put at risk. Confidentiality between lawyer and client becomes arguable the moment the data leaves.

This is not an abstract warning. In 2023 Samsung restricted internal use of ChatGPT after employees pasted source code and internal meeting notes into it. Make the same mistake on a forensic case and there is no reasonable answer left when opposing counsel asks how the evidence was protected. If you suspect an employee pasted data into an AI service, we explain how to look for the traces in can ChatGPT conversation history be evidence.

Where AI genuinely helps

Used correctly, AI accelerates the expert without replacing them. The uses that hold up in practice are these:

Use Why it is safe Verification requirement
Writing Python or PowerShell scripts The code is run and the result observed Read the script, test it on sample data
Generating regular expressions Regex is deterministically testable Validate against a known sample set
Explaining a log format or file structure General technical knowledge, no file shared Compare with official documentation
Simplifying report language Wording changes, findings do not Technical claims must stay identical
Translating foreign technical text You already hold the source text Check terminology with an expert eye
Producing hypotheses and checklists Directional, not conclusive Verify every item with a tool

The common thread: AI narrows the question, the tool provides the answer. You take a regex from the model, run it inside FTK or Autopsy, and report what the tool returns. What enters the report is the tool output, not the model's sentence.

Working without letting data leave

The technical answer to the confidentiality problem is to keep the data away from the model rather than bringing the data to the model. Engines that run locally and send no outbound request meet this need. The KAOS AI security engine developed by DSET is built on exactly that principle: fully local operation, with no data leaving the organization. In forensics the difference between a cloud assistant and a local engine is not convenience, it is legal compliance.

Should AI use be disclosed in an expert report

Short answer: yes. The methodology section states which tool was used for which purpose. If you used AI only for script generation or language editing, saying so does not weaken the report, it demonstrates transparency. Concealing it makes the entire report arguable if the other side discovers it.

Practical rules for safe use

  1. Do not upload files. No image, log, email or spreadsheet under examination should reach a cloud model.
  2. Anonymize personal data. If you must ask a question, strip names, national ID numbers, bank accounts and email addresses.
  3. Verify every output. If the model gives a CVE number, a legal provision or a registry path, confirm it from the official source.
  4. Ask about method, not conclusion. "How do I examine this artifact and with which tool" is the right question, not "what does this evidence mean".
  5. Write an internal policy. Which data may enter which tool must be documented.
  6. Prefer local models. For sensitive work use solutions that never leave your environment.

Frequently asked questions

Can ChatGPT acquire a disk image? No. Imaging requires physical access and write protection, performed with tools such as FTK Imager, Guymager or dd.

Is uploading evidence to an AI a crime? Defining it as a crime on its own would be inaccurate, but transferring evidence containing personal data to a third party without a lawful basis can constitute a data protection violation. In ongoing investigations, confidentiality obligations are assessed separately.

Will a court accept a report prepared with AI? What matters is who signed the report and whether the method is reproducible. If findings rest on verifiable tool output and AI was only an assistant, there is no problem. If the source of a finding is the model's sentence, the report cannot be defended.

Will AI replace the forensic examiner? Not in the near future. Chain of custody, legal responsibility and defending findings in court belong to a human. AI speeds up preparation and triage.

Does using a local AI remove the risk entirely? It largely removes the confidentiality risk because data never leaves the organization. Hallucination and the duty to verify still apply to local models.

Sources

Using AI in the right place accelerates your examination. Using it in the wrong place invalidates your report. To discuss the right method for your case, contact DSET. From our Ankara Hacettepe Teknokent laboratory we run forensic examinations, chain of custody and expert report processes end to end.