AI-Driven Digital Forensics: A Systematic Review of Capabilities, Limitations, and Research Challenges

The rapid growth of digital crime through cyber intrusions, ransomware, social engineering, and cloud exploitation has substantially increased the volume, heterogeneity, and complexity of digital evidence. Modern investigations span mobile devices, operating systems, volatile memory, networks, cloud infrastructures, and emerging environments such as the Internet of Things (IoT) and blockchain, challenging the scalability of conventional forensic workflows. Artificial Intelligence (AI) and Machine Learning (ML) offer promising capabilities to automate evidence analysis, identify complex patterns, and accelerate investigative processes. This systematic review provides a comprehensive and critical synthesis of AI/ML applications across major digital forensic domains, including file, memory, network, cloud, IoT, blockchain, mobile, social media, multimedia, biometric, vehicular, and drone forensics, as well as cross-cutting investigative tasks. A structured literature search and eligibility assessment identified 76 studies for qualitative synthesis. The review synthesizes the literature with attention to dataset availability, validation practices, reproducibility, explainability, adversarial robustness, and forensic admissibility. Beyond descriptive synthesis, this study introduces a six-dimensional task maturity framework based on observability, labelability, stationarity, time-to-insight, explainability, and adversarial robustness. An evidence audit links individual ratings to supporting references and qualifications. The framework assigns literature-informed ordinal scores using explicit dimensional criteria. Supporting references, rationales, and scope limitations are documented for all 96 task-dimension ratings. Sensitivity analysis examines the same profiles under alternative weights, thresholds, and individual rating changes. The reference mapping does not independently establish the validity of each numerical level. Contextual and interpretive judgment remains constrained by the need for human situational and legal reasoning. The review further identifies persistent gaps in benchmark datasets, real-world validation, explainability, adversarial testing, and legal defensibility. These findings motivate a research agenda centered on standardized evaluation protocols, robust and explainable forensic AI, improved benchmark resources, and accountable human–AI collaboration. Overall, this study provides a structured assessment of the current capabilities and limitations of AI/ML in digital forensics and identifies priorities for developing reliable, transparent, and legally defensible intelligent forensic systems.