How to Build a Second Brain for a Digital Investigation — A Case Study

Mobile forensic investigations generate data from applications, cloud services, and devices. Although investigators must combine these sources, systematic records of interpretations and cross-case relationships are often lost between investigations. This study applies Karpathy's "second brain" framework to mobile forensics, introducing a persistent forensic knowledge architecture as an alternative to retrieval-augmented generation (RAG). The architecture comprises three levels: immutable source data, an LLM-generated and maintained wiki, and procedural rules. The raw data layer preserves evidence; the wiki provides a cross-referenced knowledge base covering individuals, applications, and timelines; and procedural rules define case workflows. The architecture does not propose an LLM-based forensic analyst. Instead, an LLM operates as one component within an agent-driven forensic process. Evaluation on two Digital Corpora datasets (iOS 17 and Android 14) produced a 51-page knowledge base containing 525 internal references, 99.6% of which resolved correctly. Manual verification of facts against build logs found no contradictions, although nearly one-third could not be confirmed from documentation. The system demonstrated cross-application entity linking, multi-time-zone timeline reconstruction, and detection of deliberately hidden or deleted data. Comparison with a locally hosted open-weight model highlights quality/privacy trade-offs. Findings support persistent forensic knowledge management while underscoring the need for human oversight.