Digital video surveillance systems are now common in the security infrastructure of modern times, but proprietary file systems provided by large manufacturers are a major challenge to the work of the forensic investigator. This paper proposes a forensic recovery methodology of Hikvision and Dahua surveillance systems by utilizing three major innovations: (1) adaptive temporal sequencing, which dynamically changes gap detection thresholds; (2) dual-signature validation with header–footer matching of DHFS frames; and (3) automatic manufacturer identification. The strategy puts into practice direct binary analysis of proprietary file systems, frame-based parsing and automatic video reconstruction. Testing on 27 surveillance hard drives showed a recovery rate of 91.8, a temporal accuracy of 96.7% and a false positive rate of 2.4%—the lowest of the tools tested with statistically significant improvements over commercial tools (p < 0.01). Better results with fragmented streams (87.2 vs. 82.4% with commercial tools) meet key forensic needs of determining valid evidence chronology. The open methodology offers the necessary algorithmic transparency to be court-admissible, and the automated MP4 conversion with metadata left intact makes the integration of forensic workflow possible. The study provides a scientifically validated approach to proprietary surveillance formats, which evidences technical innovativeness and practical usefulness to digital forensics investigations.

Analog digital video recorders (DVRs) are still extensively used in small-to-medium business and home security systems, but there are special problems when it comes to forensic recovery of video evidence in these systems that are not covered by tools or methodology. Compared to the IP-based network video recorders, analog DVRs packetize video frames of several coaxial-connected cameras into a single interleaved binary stream on disk, necessitating channel demultiplexing before single camera footage can be reassembled. In this paper, we discuss a multi-channel analog Dahua DVR system utilizing the DHAV frame format, with a focus on the forensic recovery approach. Three significant contributions are presented in the methodology: (1) a channel demultiplexing algorithm that separates interleaved frames with up to 32 cameras on the basis of embedded channel identifiers and temporal coherence analysis; (2) a frame sequence stitching mechanism to reassemble continuous video segments on the basis of non-contiguous disk fragments using adaptive frame number tolerance (±3 frames) and temporal validation (≤1 second difference); and (3) a native C implementation with Win32 GUI providing significant performance improvements over interpreted alternatives. The system was tested on 14 analog Dahua DVR hard drives of various models, with a 92.3% recovery rate (97.1% on hard drives with no hardware damage), 91.3% temporal accuracy, 97.5% channel separation accuracy and a 1.8% false positive rate. The methodology fills an important gap in the literature of surveillance forensics, where current studies have only concentrated on IP-based digital systems, and analog DVRs form an estimated 35–40% of operational surveillance systems across emerging markets. The channel demultiplexing capability, which is not found in any current commercial or academic tool, enables automated per-camera organization of interleaved streams, converting what was previously a manual multi-day process into an automated one.

(1) Background: The digital traces of unmanned aerial vehicles (UAVs) are becoming increasingly important in criminal incidents, the violation of airspace and in military operations, thus making the reconstruction of the digital traces a critical task. But, current tools like DatCon, Autopsy and GRYPHON cannot recover telemetry when the flight logs are logically damaged, fragmented or partially deleted and don’t offer any quantitative measurement of the confidence of the recovered information. (2) Methods: A unified hardware-software complex, including a forensic workstation, a hardware write-blocker and SD/microSD/eMMC adapters; a set of software modules for extracting artifacts from files, structural parsing of DAT/BIN/CSV log, neural network reconstruction of missing telemetry using a two-layer LSTM architecture; a multi-source correlation module that combines flight logs, telemetry, media metadata and controller artifacts; a module, Confidence Score (CS), that computes a reliability measure in $[0,1]$; and a visualization module to generate a reconstructed trajectory on an electronic map. (3) Results: The complex has been tested on 105 flights on 10 different UAVs, 492 flight logs were gathered, 10,435 were the media item files and 624 GB was the amount of storage during acquisition. The carving stage recovers 98.7% of artifacts across the eight signature classes, the LSTM module recovers all five telemetry parameters with $R^2>0.99$ and a single-step horizontal position error of 6.8 m, which is reduced to 4.7 m after multi-source correlation (below the 5 m operational target consistent with consumer-GNSS precision); the dependence on gap length is described by the empirical growth law ${\epsilon }_{\mathrm{horiz}}\approx 4.84·G^{1.44}$ m; 46.8% of recovered records fall within the high-confidence band of $\mathrm{CS}\ge 0.8$; and the complex outperforms DatCon, Autopsy + DJI Analyzer and GRYPHON by 22–35 percentage points in end-to-end record recovery and by a factor of ∼2.6 in mean horizontal error (4.7 m vs. 12.4–18.7 m). (4) Conclusions: The combined write-blocked hardware acquisition, neural reconstruction of telemetry, and quantitative confidence index provides a forensically structured pipeline that fills an existing gap in UAV digital forensics; we note that technical reconstruction accuracy does not by itself confer legal admissibility, which remains a function of jurisdiction-specific evidentiary standards discussed in the Conclusions.

(1) Background: The disaggregated and software-defined nature of fifth-generation (5G) core networks and the Open Radio Access Network (O-RAN) architecture increase the attack surface and produce large volumes of heterogeneous evidence that must be analyzed in real time to support incident reconstruction. Open-source 5G stacks (including Open5GS and srsRAN) have become reference platforms in the literature, yet recent research, such as the RANsacked study that reported 119 vulnerabilities and 97 unique CVEs across multiple LTE/5G implementations, have highlighted the pressing need for AI-based detection and forensic capabilities specific to these stacks. (2) Methods: We introduce an experimental framework consisting of a reproducible srsRAN+Open5GS testbed and an AI-driven forensic and detection pipeline. The pipeline receives control-plane (NAS, NGAP, F1AP) and Service-Based Interface (SBI) traffic, extracts protocol- and statistically grounded features and classifies traffic into seven attack types using a hybrid CNN–LSTM model. Integrity-protected and timeline-correlated forensic artifacts (PCAP, logs, memory dumps) assist in reconstructing an incident. (3) Results: The proposed hybrid model achieves a macro F1-score of 0.972 and an AUC-ROC of 0.995 (5-fold CV) and degrades gracefully under load. (4) Conclusions: We show that AI-based detection can be coupled with a scientifically sound evidence chain in open-source 5G stacks deployed as disaggregated mobile networks.

Bank statements are information-rich but labour-intensive forensic sources: differing formats, inconsistent field naming, incomplete counterparty attributes and mixed debit–credit conventions make cross-account comparison unsafe, and an automated summary is easily read later as established fact. We propose a reproducible normalization model converting heterogeneous statement records into one auditable transaction journal, each row bound to its source line. It separates the source document, the normalized record and the interpretive indicator, formalizes an eight-stage cycle from inventory and hash control to quality control and indicator generation, and attaches an evidential status to every reconstructed route. The evaluation is entirely synthetic: the corpus, whose defects have known type and position, was generated by the same authors who built the control layer, so the scores below are an internal-consistency check rather than evidence of performance on real bank exports. The corpus, its generator and a reference implementation of the model are released with the article. Across 1200 transactions from 30 files and 15 layouts, all 8 mandatory fields map completely while counterparty identifiers reach 0.573. The control layer flags 55 of the 57 injected defects with no false candidate; the two misses are undetectable by construction and are reported as such. Reclassifying one channel-only record changes precision from 1.000 to 0.982 and $F_1$ from 0.982 to 0.973. On eight fault types the generator never produces, seven are surfaced in the defect log and one, a day–month swap, passes largely unnoticed. On data with no planted behavior, the indicators flag from none to 11 of 12 subjects depending on the threshold, so thresholds need calibration against a reference population. Removing the lineage tuple or the defect log leaves detection unchanged while removing source references or suppressing some logged warnings, showing that detection scores alone do not describe the output’s auditability. Validation on real exports and review by independent assessors remain open.

The exponential growth of digital data and the increasing sophistication of cyber threats have made traditional data recovery methods, which rely on file system metadata and signature-based carving, inadequate for modern forensic investigations. Solid-state drives with TRIM and wear leveling, file fragmentation and partial corruption frequently leave investigators with incomplete evidence and without any quantitative measure of its reliability. The aim of this study is to develop and validate a machine learning-based ensemble framework for intelligent byte-level data recovery and integrity assessment. The proposed method extracts an 18-dimensional feature vector describing the statistical, structural, entropy and pattern properties of each file segment and combines three complementary models: a Random Forest that predicts individual byte values from contextual windows, a Gradient Boosting model that reconstructs pattern-level structure, and a multilayer perceptron that estimates structural recovery confidence. Their outputs are merged through weighted voting with weights optimized by cross-validation, followed by structural validation and a multi-metric confidence assessment. The framework was evaluated on 10,247 files (PDF, JPEG, PNG, DOCX, MP4) stored on NTFS, ext4 and APFS and subjected to 15 synthetic corruption scenarios, including bit errors, block deletion, header damage, fragmentation, zero padding and pseudo-encrypted regions. The ensemble achieved 89.3% recovery accuracy and 92.1% precision, substantially surpassing Autopsy (62.4%), FTK Imager (58.7%) and EnCase (74.5%), and all improvements were statistically significant (p < 0.001). Accuracy remained stable across file systems (87.1–91.7%), and the confidence scores were well calibrated, with an Expected Calibration Error of 1.48%. The price of this gain is a longer processing time of 45.2 s per file. The results show that combining ensemble byte-level reconstruction with calibrated integrity assessment yields more complete evidence together with quantitative confidence measures suitable for legal proceedings, providing a practical complement to existing forensic tools.