Using Machine Learning to Prioritize Forensic Artifacts in Email Evidence

This paper addresses one of the challenges of digital forensics by enhancing the analysis phase, focusing on prioritizing forensic artifacts in email evidence using machine learning. The urgency stems from the growing volume and variety of digital evidence, leading to backlogs in forensic laboratories. The research explores how categorizing forensic artifacts by priority can optimize the criminal investigation. The study develops and evaluates three machine learning models: Decision Tree, Support Vector Machine (SVM), and Fully Connected Neural Network (FCNN). These models are assessed based on their accuracy, strengths, limitations, and ability to prioritize email evidence. Results indicate that the SVM model is the most accurate and consistently performing well, while the FCNN model uniquely classifies all validation set emails correctly.