DOLPHIN: A Privacy-Preserving Digital Investigation Readiness Assessment Framework based on Offline Large Language Models and Retrieval-Augmented Generation
This paper introduces DOLPHIN, a privacy-preserving framework that leverages offline large language models and retrieval-augmented generation to significantly enhance digital forensic investigation readiness by accurately assessing evidence completeness, detecting specific gaps, and reducing case preparation time while ensuring data remains local.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the author. For technical accuracy, refer to the original paper. Read full disclaimer
In the world of criminal investigations, the most critical work often happens before a single piece of evidence is formally analyzed in a laboratory. Before detectives can examine a hard drive or a phone, they must first determine if they have enough information to even begin. This preliminary stage, known as forensic readiness, involves gathering a chaotic mix of documents: a victim's statement, a police report, security camera footage, witness accounts, ownership papers, and digital timestamps. Traditionally, sorting through this pile has been a slow, manual process. If a key document is missing or a timeline is unclear, the entire investigation can stall, or worse, proceed on a shaky foundation. The challenge is not just finding the evidence, but quickly assessing whether the available materials are complete enough to support a serious inquiry, all while keeping sensitive details strictly private and away from the internet.
A new framework called DOLPHIN offers a different way to handle this early-stage sorting. Developed by researchers at the SRM Institute of Science and Technology in India, the system is designed to act as a privacy-focused assistant for investigators. Instead of sending confidential case files to a cloud server where they could be exposed, DOLPHIN runs entirely on a local computer. It uses a type of artificial intelligence known as a large language model, which is trained to understand and generate human language, combined with a retrieval system that pulls specific facts from the uploaded documents. This setup allows the computer to read a case file, check for missing pieces, and score how ready the investigation is, all without ever leaving the investigator's secure room. The goal is to turn a tedious, subjective checklist into a fast, reliable, and private assessment.
To test if this approach works, the researchers created a controlled environment using 300 simulated investigation scenarios based on vehicle theft cases. They did not use real police files to protect privacy; instead, they built digital versions of cases that ranged from having every possible document to having very few. Some scenarios included a full victim statement, a police report, security footage, and witness accounts, while others deliberately left out specific items like ownership papers or digital timestamps. The researchers then fed these scenarios into the DOLPHIN system to see if it could accurately judge the completeness of each case. The system was tasked with two main jobs: first, to assign a readiness score that indicated whether a case was ready for deep forensic analysis, and second, to identify exactly what was missing, such as a gap in the visual evidence or a lack of corroboration from witnesses.
The results showed that the system performed with high accuracy. When asked to classify the readiness of a case, DOLPHIN matched the judgment of human experts about 92 percent of the time. It was particularly good at spotting specific types of missing information. For instance, it could reliably detect when a case lacked a victim's statement or when the timeline was broken due to missing digital metadata. The system categorized these missing pieces into four clear groups: gaps in documentation, gaps in witness corroboration, gaps in visual evidence like CCTV, and gaps in the timeline. By identifying these specific holes, the system provided investigators with a clear picture of what they needed to find before moving forward, rather than just giving a vague "yes" or "no" answer.
A crucial part of the study was ensuring the system did not make things up. Large language models can sometimes generate confident-sounding but false information, a problem known as hallucination. To prevent this, the researchers used a technique called retrieval-augmented generation, which forces the computer to look at the actual documents in the case file before answering. They further improved this by filtering the search results with metadata, ensuring the system only looked at documents belonging to the specific case it was analyzing. This combination reduced the rate of unsupported or false statements from over 16 percent down to just 2 percent. In other words, the system became much more trustworthy because it was strictly tethered to the evidence provided, rather than relying on its general training data.
Beyond accuracy and trust, the study measured how much time the system saved. A human investigator reviewing a case file manually took an average of about 15.5 minutes to check for completeness and identify missing pieces. With DOLPHIN assisting, that time dropped to roughly 4.4 minutes per case. This speedup did not come at the cost of quality; the reports generated by the system were more complete than those produced by manual checklists, consistently including a summary of evidence, a list of missing items, a readiness score, and recommended next steps. The system proved that it could handle the heavy lifting of organizing information, allowing human investigators to focus their energy on the actual investigation rather than administrative sorting.
The researchers emphasized that DOLPHIN is not a tool that makes final legal decisions or replaces the need for human judgment. It is designed as a support system to help investigators organize their thoughts and materials before the formal forensic examination begins. The study was conducted using simulated data on standard consumer-grade laptops, demonstrating that this level of privacy-preserving assistance does not require expensive, enterprise-level supercomputers. While the system showed great promise in these controlled tests, the author notes that future work will need to validate its performance with real-world police cases, which can be far more complex, ambiguous, and legally sensitive than the simulations used here. For now, the study suggests that keeping artificial intelligence local and grounded in specific documents can be a powerful way to prepare for digital investigations without compromising privacy.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.