The massive storage capacity of electronic devices has significantly increased the volume of evidentiary data encountered in digital forensic investigations. As a result, the automation of digital evidence analysis employing deep learning techniques has become a trend. The training data distributions for deep learning techniques are typically balanced, which means that the data size of each class is roughly the same. However, in the digital forensics domain, evidence is mostly imbalanced, containing a large proportion of normal data and a small proportion of anomalous data. As a result, deep learning algorithms have to be enhanced to achieve good performance on imbalanced evidentiary data. This chapter focuses on a common digital evidence analysis task – identifying Android malware dispersed in a large number of normal files. An imbalance tuning method leveraging bidirectional encoder representations from transformers (BERT) is employed to overcome the imbalanced data problem. The BERT model is trained with balanced training data and subsequently tuned using imbalanced data. The model achieves a low false positive rate and a high malware detection rate with an overall performance (F-score) of 90.26% when the positive sample population in the testing set is set to 1%.