Imagine you're a health inspector examining a restaurant kitchen, but the rats have learned to leave fake inspection reports on the counter — and your clipboard automatically files them as your own findings. That's the core mechanism here: when LLMs assist digital forensic examiners, the evidence under investigation IS the attack surface, and the attacker controlled that evidence before it was ever seized. The committed claim: LLM-assisted digital forensics creates a fundamentally new anti-forensic target — the reasoning layer — that classical anti-forensic taxonomies (which cover data destruction, data hiding, and tool subversion) do not address. The authors extend the existing anti-forensic model with a fourth category and demonstrate it works in practice. This isn't the first prompt-injection paper, but it IS the first to formalize the unique structural vulnerability of forensic workflows specifically: unlike chatbots or code assistants, the forensic examiner is OBLIGATED to process attacker-controlled content. There is no 'just don't open suspicious files' defense. The taxonomy is the real contribution. Attacks are decomposed along four axes: objective (what the attacker wants), technique (how the injection works), payload location (where in the evidence it hides), and concealment method (why the human examiner doesn't see it). The key insight the authors call the 'perception gap' — deterministic tools, the human examiner, and the LLM perceive the same evidence differently. A string invisible to a hex editor review might be parsed and executed by the model's tokenizer. This asymmetry is what makes the attack vector structurally different from classical prompt injection in chatbots. Three proof-of-concept attacks demonstrate escalating severity against an LLM-assisted analysis pipeline. First: planted text causes the model to alter its reported forensic conclusion — the equivalent of evidence tampering at the interpretation layer. Second: injected instructions cause the LLM to write attacker-chosen content to the analyst's workstation, achieving code execution through the model's tool-use capabilities. Third: crafted evidence triggers outbound network traffic from the forensic workstation, a data exfiltration pathway. All three attacks are driven solely by text planted on the seized device before seizure. The architecture under attack is the now-standard 'LLM-as-agent' pattern: a large language model with tool access (file system read/write, network, shell) processing structured and unstructured data from forensic images. The vulnerability isn't in a specific model — it's in the workflow pattern of giving an LLM both read access to untrusted evidence and write/execute access to the analyst's environment. This is the same agentic trust boundary problem showing up in software engineering copilots and autonomous coding agents, but with higher stakes: forensic conclusions feed courtroom testimony. Integrity-wise, this is a proof-of-concept paper, not a benchmark paper. The three demonstrations are compelling but narrow — they show specific attack instances, not systematic success rates or failure modes. No success-rate statistics are reported, no adversarial robustness benchmarks are used, and the specific LLM model and pipeline configuration aren't fully specified in the abstract. The mitigations proposed are described but not empirically validated. This is a 'the lock is broken' paper, not a 'here's a better lock' paper. The field fight this paper enters is real and urgent: should LLMs be given agentic tool access in high-stakes workflows before adversarial robustness is solved? The forensic community is adopting these tools NOW — vendors are shipping LLM-assisted forensic platforms — and this paper argues the security model is fundamentally broken. The next milestone is clear: either robust sandboxing architectures that provably separate the evidence-processing channel from the action channel, or formal verification that an LLM's outputs cannot be steered by in-context injections. Neither exists today.
