Research
Research
Research themes spanning digital forensics, cybersecurity, applied AI, computer vision for investigations, cloud and IoT forensics, and forensic education.
Mark Scanlon’s research interests sit at the intersection of digital forensics, cybersecurity, and applied AI, developing and rigorously evaluating methods and tools that make digital evidence acquisition and analysis more efficient, automated, reliable, and reproducible.
The current research themes listed here are drawn from the existing personal site, publication record, and Forensics and Security Research Group profile.
Themes
Research Focus
Digital Forensics
Digital evidence acquisition and analysis methods that improve efficiency, reliability, automation, and reproducibility.
Cybersecurity
Security research connected to forensic readiness, cybercrime investigation, and practical investigative workflows.
AI for Forensics
Applied AI methods for evidence processing, investigation support, tool testing, and forensic workflow automation.
Computer Vision for Investigations
Computer vision approaches for digital forensic tasks including image analysis and investigative triage.
Cloud, IoT, and DFaaS
Research on cloud services, Internet of Things devices, Digital Forensics as a Service, and large-scale evidence handling.
Forensic Education
Teaching and curriculum activity in computer forensics, cybercrime investigation, and specialist digital investigation modules.
Related Output
Recent Publications
Objects as Universal Geolocation Cues: A Computer Vision Approach
13th Annual Digital Forensics Research Workshop Europe (DFRWS EU 2026)
This paper proposes a computer vision approach to geolocation using universal visual cues, specifically electrical plug sockets, to narrow down the search space for law enforcement in combating crimes such as human trafficking and child exploitation.
Publication page
VAAS: Vision-Attention Anomaly Scoring for image manipulation detection in digital forensics
Forensic Science International: Digital Investigation Vol. 56 pp. 302063
VAAS detects image manipulation using Vision Transformers and segmentation embeddings, providing a continuous anomaly score for digital forensics.
Publication page
Plug to place: Indoor multimedia geolocation from electrical sockets for digital investigation
Forensic Science International: Digital Investigation Vol. 56 pp. 302056
This paper introduces a pipeline for indoor multimedia geolocation using electrical sockets as consistent markers, aiding law enforcement in human trafficking investigations.
Publication page
Investigation of large language models, GenAI, and proprietary AI systems: Digital forensic evidence, readiness and regulation
Forensic Science International: Digital Investigation Vol. 57 pp. 302135
This paper investigates digital forensic evidence and regulation of large language models and proprietary AI systems, highlighting the need for AI forensic readiness and examinability.
Publication page
AutoDFBench 1.0: A benchmarking framework for digital forensic tool testing and generated code evaluation
Forensic Science International: Digital Investigation Vol. 56 pp. 302055
AutoDFBench 1.0 is a benchmarking framework for digital forensic tool testing, evaluating conventional and AI-generated tools across five areas: string search, deleted file recovery, file carving, Windows registry recovery, and SQLite data recovery.
Publication page
Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis
Forensic Science International: Digital Investigation Vol. 54S pp. 301982
This paper proposes a standardized methodology for evaluating the performance of Large Language Models (LLMs) in digital forensic timeline analysis tasks, such as event summarization. The methodology includes a dataset, timeline generation, and ground truth development, and recommends the use of BLEU and ROUGE metrics for quantitative evaluation.
Publication page