Intention Recognition for Digital Forensics: A Formal Model

The rapid advancement of technology has been matched by a significant rise in cybercrime, posing substantial challenges for digital forensics investigators who must handle increasingly complex cases and navigate vast volumes of evidence. While current research on intent recognition has largely focused on cybersecurity measures for preventing attacks, there has been a noticeable gap in the integration of legal intent analysis with technical digital forensics. This paper addresses this gap by presenting an innovative model that combines legal and technical perspectives through a formal model. The model consists of three core components—Evidence Analysis, Intent Recognition, and a Criminal Repository—that systematically process digital evidence, reconstruct crime scenes, identify criminal intent, and offer recommendations for the conviction process. Using formal methods, the model rigorously defines key concepts such as crime, intent, and intent types, ensuring its robustness and reliability. By stimulating the model using phishing attack scenarios, we validate the model’s capability, demonstrating its ability to identify various types of intent and manage complex cases. Looking forward, we suggest implementing the model by incorporating advanced AI approaches, particularly Agentic AI, or combining logic-based methods with explainable AI. This advancement would help address huge volume-related challenges of digital forensics and provide a powerful tool for modern investigative practices.