A Multi-Agent Traceable Semantic Graph Architecture for Digital Forensic Knowledge Representation and Relational Inference

Abstract

Digital forensic investigations increasingly depend on the interpretation of heterogeneous evidence recovered from multiple computational artifacts. Although extraction tools have advanced considerably, connecting recovered traces to investigative reasoning remains a technical challenge, particularly when provenance and traceability must be preserved for later examination. This dissertation introduces a graph-centered multi-agent framework for organizing digital forensic evidence as a structured semantic representation linked to artifacts extracted from forensic disk images. The framework connects entities, semantic relations, provenance metadata, and investigative hypotheses within a unified Digital Forensic Knowledge Graph, enabling relational inference under incomplete-evidence conditions. Experimental evaluation showed 73.3% concept recovery, 73.3% semantic relation recovery, 57.0% hypothesis coverage, and full traceability coverage for evidentiary relations. Among the evaluated inference models, node2vec_b f s_ppmi_negative_l2 achieved the strongest overall performance under controlled perturbation settings. The findings show that graph-based semantic representation can support forensic reasoning while maintaining explicit linkage between inferred relations and traceable digital evidence.