How to Use AI Tools to Speed Up a Digital Forensics Investigation

01

Windows Event Log Triage   |   ChatGPT, Claude, or Microsoft Copilot 

PROMPT: Export relevant EVTX logs to CSV or text using EvtxECmd or Get-WinEvent. Paste a focused block (500-1000 lines maximum) into the AI with a specific instruction: "You are a digital forensics analyst. Identify authentication anomalies, privilege escalation events, lateral movement indicators, and any Event IDs associated with known attack techniques in MITRE ATT&CK. Present findings as a numbered list with the Event ID, timestamp, and why it is significant." 

OUTPUT: A structured list of suspicious events extracted from raw log data in seconds rather than hours. The analyst then validates each finding against the raw log. The AI found it. The analyst confirms it. 

02 

Volatility Memory Analysis Summarisation   |   Claude or ChatGPT with plugin output 

PROMPT: Run Volatility plugins: pslist, pstree, netscan, malfind, cmdline. Copy the output of each plugin into the AI with instruction: "You are a memory forensics analyst. Analyse this Volatility output. Identify: processes that appear suspicious (unusual parent-child relationships, unusual paths, or known malware process names), active or recently active network connections to external IPs, and any indicators of process injection or hollowing. For each finding, state what it is, why it is suspicious, and what you would investigate next." 

OUTPUT: A prioritised triage report from memory. Unusual processes identified, suspicious network connections flagged, injection indicators highlighted. The analyst then examines each flagged item in the raw output to confirm the finding. 

03 

Timeline Narrative Generation   |   Claude or ChatGPT with log2timeline/Plaso CSV output 

PROMPT: Export a filtered Plaso timeline CSV covering a specific time window around the suspected compromise. Paste a representative sample or summary of key events. Instruct: "You are a senior incident responder. This is a forensic timeline excerpt from a compromised Windows workstation. Write a chronological narrative of what appears to have happened, including: initial access, execution, persistence mechanisms, lateral movement, and data staging or exfiltration indicators. Write in past tense as if documenting confirmed findings, but flag anything that requires additional verification." 

OUTPUT: A readable forensic narrative that can be refined into the Timeline section of your investigation report. The analyst validates each statement against the timeline evidence before it goes in the final document. 

04 

Malware Sandbox Report Interpretation   |   Claude or ChatGPT with any.run, Cuckoo, or VirusTotal output 

PROMPT: Copy the behaviour summary from a sandbox analysis. Include: network connections attempted, files created or modified, registry keys accessed, processes spawned. Instruct: "You are a malware analyst. This is a sandbox behaviour report. Summarise: the likely malware family or category, the key indicators of compromise I should add to our blocklist, the attacker objectives suggested by this behaviour, and the forensic artefacts I should look for on the victim machine." 

OUTPUT: A structured IOC list and a plain-language description of what the malware was trying to do. Feed the IOCs directly into your SIEM or threat intel platform for hunting across the environment. 

05 

Forensic Report Drafting   |   Claude with structured notes 

PROMPT: Before using AI for report drafting, produce your own structured notes: timeline of events confirmed, artefacts examined, findings per artefact, IOCs identified. Then instruct: "You are writing a digital forensics investigation report section. Using these structured notes, write the Executive Summary and Findings sections in professional forensic report language. Use past tense. State findings as confirmed observations referencing specific artefacts. Flag anything that is inferred or requires further investigation. Do not attribute actions to specific individuals." 

OUTPUT: A professional report draft that uses your findings as the source of truth. The AI handles the language, structure, and formatting. You verify every statement against your evidence before signing off.

06 

IOC Extraction From Threat Intel   |   Claude or any capable LLM 

PROMPT: Paste a threat intelligence report, blog post, or vendor advisory. Instruct: "Extract all actionable indicators of compromise from this text. Organise them into categories: IP addresses, domain names, file hashes (with hash type), registry keys, file paths, and email addresses. Present as a structured table I can import into a threat intelligence platform." 

OUTPUT: A clean, structured IOC table extracted from unstructured text in under a minute. What previously required manual copy-paste across multiple paragraphs becomes a formatted import-ready table.