Legal Admissibility of Machine Learning Reconstructed Data in Digital ForensicsLegal Admissibility of Machine Learning Reconstructed Data in Digital Forensics
Ключевые слова:
digital forensics, machine learning, data reconstruction, admissibility of evidence, Daubert standard, confidence calibration, chain of custody, file carving, GDPR, forensic reliabilityАннотация
In digital forensics, machine learning is now being employed to reconstruct information from fragments, deleted data, or partially overwritten data that traditional carving tools cannot recover. These reconstructions are not necessarily definitive, and the question that remains to be answered is this: under what conditions can model-reconstructed data be accepted as evidence in a legal discussion? This paper explores the technical and regulatory conflict between probabilistic reconstruction and the demands of evidentiary standards such as Daubert and Frye, and data-protection regimes such as the General Data Protection Regulation. We suggest a framework of three measurable components of a reconstruction — model reliability, source integrity, and independent corroboration — that can be combined into a single normalized score, termed the Confidence Score, and we propose two decision thresholds that map a reconstruction to one of three evidentiary roles: admissible exhibit, investigative lead, or excluded artifact. With a controlled fragment-reconstruction setup of 5,500 labelled outcomes, the calibrated score achieved an area under the ROC curve of 0.94, while the expected calibration error decreased from 0.17 to 0.04 after post-hoc calibration. We also identify each of the components of the score with the relevant Daubert reliability factors and demonstrate that a quantified and calibrated error rate is the single most important factor for legal defensibility. Based on the results, probabilistic reconstructions should not be used as exhibits in isolation, but they can support admissible evidence when the level of confidence is calibrated, documented, and corroborated. The major contribution is a reproducible bridge between a technical confidence level and the canonical admissibility criteria that apply to file-system, mobile, and video-recorder forensics.
Скачивания
