Query-based digital forensic triage using vision language models and explainable AI

Digital forensic triage aids investigators in quickly narrowing down the set of devices that need to be confiscated and examined when multiple digital sources, such as mobile phones, laptops, or storage media, are involved in an investigation. Manual examination of all digital sources is time-consuming and often impractical in large-scale investigations. Under such circumstances, an automated solution to identify potentially relevant data quickly is required, which could be vital for solving cases. The proposed explainable framework leverages large vision–language models (LVLM) to automatically search, retrieve, and rank image and video evidence from confiscated digital devices based on contextual queries. In addition to extracting potentially relevant data during and after triage, the proposed system helps scrutinize devices for potential evidence and accelerates the retrieval of relevant information from device images, thereby quickening the overall forensic analysis process. The investigator can enter a text or image query, and the system retrieves image and video files pertinent to that query from the devices or their forensic images, for instance, a sample query could be “elephant tusk.”. The framework was evaluated on benchmark datasets as well as forensic corpora including Rhino Hunt and Digital Corpora images (National Gallery DC Attack), and further validated through a case study on elephant tusk evidence detection. Explainability modules using GradCAM, LIME, Integrated Gradients are integrated to provide interpretable evidence heatmaps for each retrieval. The proposed framework could attain an accuracy and F1-score of 0.98 and 0.97 for the image retrieval phase and a recall@k greater than 0.8 and 0.9 for the video retrieval model. The results indicate that combining VLMs with forensic workflow adaptation and explainability significantly enhances robustness, transparency, and reliability of content retrieval in digital forensic triage. A comparative discussion is provided with industry-standard forensic AI tools such as Magnet COPILOT, Griffeye BRAIN, Semantics 21, and BelkaGPT, highlighting how the proposed framework complements these solutions.