AdvancedAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics unitsAI / Machine Learning Forensics
Use machine learning to sort large evidence sets and investigate AI systems
- Advanced
- Online or on campus
- 5 hands-on labs
- 7 modules
About this course
Two kinds of work sit under this name. The first is using machine learning to help forensic work. A seized laptop with four lakh photos or a phone with years of chats cannot be read item by item, so classifiers and clustering help an examiner decide what to look at first. The second is investigating AI systems themselves, where a chatbot, a model or a data pipeline is part of the incident.
For triage, the course is honest about limits. A model that flags weapons or documents in images will miss some and wrongly flag others. You learn to measure that with precision and recall on your own test sets, to spot bias when a model trained on foreign data meets Indian faces, Indian scripts or low-light CCTV, and to describe what the tool did in words a judge can follow. The examiner, not the model, makes every finding that goes into the report.
For AI systems, you learn what they leave behind: model files and their hashes, configuration and training data, API logs, prompt and response histories, vector databases and the keys used to call cloud models. Typical cases include customer data leaking through a company chatbot, misuse of an internal AI tool and fraud scripts written with a public model.
Machine learning triageExplainability in courtError rates and biasAI system artefacts
After this course you can
- explain how classification, clustering and language processing are used in forensic triage
- measure a model's error rate on a test set and report precision, recall and false positives
- recognise bias in training data and explain how it can affect a finding
- document a machine-learning-assisted examination so another examiner can repeat it
- identify and preserve the artefacts of an AI system, from model files to prompt logs
- tell a court what a tool's output means and what it does not prove
Syllabus
7 modules · 28 topics
01Machine Learning for Examiners4 topics
- Supervised and unsupervised learning in plain terms
- Features, training data and test data
- Classification, clustering and similarity search
- What a confidence score is and what it is not
02Machine Learning in Triage4 topics
- Image categorisation in forensic suites
- Finding near-duplicate images with perceptual hashing
- Sorting chats by topic or language, including Hindi and Hinglish
- Keeping a human review step for every item that will be relied on
03Error Rates and Validation4 topics
- The confusion matrix: true and false positives and negatives
- Precision, recall and false positive rate
- Building a small validation set from data where the answer is known
- Recording tool version, model version and thresholds for every run
04Bias and Reliability4 topics
- Training data that does not match Indian cases
- Poor inputs: low-light CCTV and heavily compressed messaging app images
- Results changing between software versions
- Knowing when a model should not be used at all
05Explaining Results in Court4 topics
- SHAP and LIME explained without maths
- Showing the examples behind a model's decision
- Writing the method section of a report
- Preparing for questions on error rates during cross-examination
06Investigating AI Systems5 topics
- Model files such as .pt, .safetensors, .onnx and .gguf and how to hash them
- Training data, configuration files and application logs
- Prompt and response histories, chat exports and API usage records
- Locally run models, their stored files and history on a seized computer
- Vector databases behind retrieval-based chatbots
07Case Work and Evidence Handling3 topics
- A data leak through an internal chatbot, from first alert to report
- Requesting logs from cloud AI providers through the proper legal route
- Chain of custody for models and datasets
Hands-on labs
- Lab 1
Run an image categorisation pass on a labelled test set and work out precision and recall
- Lab 2
Cluster a chat export by topic in Python and review each cluster by hand
- Lab 3
Use SHAP on a simple classifier and write a one-page explanation for a non-technical reader
- Lab 4
Examine a laptop image that ran a local language model and recover the model files, prompts and history
- Lab 5
Write the method section of a report for a machine-learning-assisted examination
Tools you will use
- Python
- Jupyter
- scikit-learn
- SHAP
- LIME
- Netron
- Magnet AXIOM
- Griffeye Analyze DI
- Autopsy
Who it suits
- Forensic examiners handling cases with very large data sets
- Data scientists moving into forensic or investigation work
- Corporate investigation and security teams
- Researchers working on forensic tools
- Lawyers who need to test AI-based evidence
Before you join
- Basics of Cyber Forensics or experience in a forensic lab
- Basic Python, enough to read and run a short script
- School level maths: percentages and ratios
Questions about this course
Do I need to be a data scientist?
No. You need to understand what a model does, how to test it and how to explain it. The Python used in the labs is short and explained line by line.
Can a finding made by an AI tool be used as evidence?
The tool only points to items. The examiner checks each item, makes the finding and explains the method, including the tool, its version and its known error rate. That finding is what goes into the report.
Does this course cover deepfakes?
Deepfake detection is taught in the Deepfake / AI Forensics course in the Surveillance, Image & Video Forensics track. This course covers machine learning triage and the investigation of AI systems.
Will the tools decide what is relevant in a case?
No. They help put the most likely items first. Relevance is decided by the examiner, who reviews what the tool flagged and also samples what it did not flag.
More courses in Advanced & Specialised Forensics
AdvancedAutomotive / Vehicle ForensicsRecover paired phones, trip logs and events from infotainment and telematics units
AdvancedCryptocurrency / Blockchain ForensicsTrace bitcoin and USDT flows, group wallets and prepare requests to exchanges
AdvancedOSINT / Open Source IntelligenceFind, verify and record public online information in a form a court can checkNot sure this is the right one for you?
Tell us your background and what you want to do next. A counsellor will suggest a course and the next batch.