Can Investigators Rely on DeepSeek Artifacts from Mobile Devices? An In-depth Forensic Analysis
Primary Investigator:
Umit Karabiyik
Yufeng Gong; Sonali Tyagi; Vaishnavi Mahindra; Umit Karabiyik
Abstract
As an application focusing on artificial general intelligence (AGI), open-source LLM DeepSeek has been widely adopted by many research institutions and international companies around the world. More than 60 million daily active users have been reported on DeepSeek by QuestMobile. Given DeepSeek's rapid growth in user population and the fact that mobile devices gradually function as centers for users to interact with AI-driven applications, it is essential to conduct thorough mobile forensics along with network forensics on the Deepseek’s mobile app to discover potential evidence stored in both Android and iOS devices and provide valuable insight into its potential vulnerabilities. This investigation focused on user data and system usage such as log files, metadata, and other critical traces that can reveal insights into its operational behavior in different versions of DeepSeek and data packets sent over the network. Ultimately, this research help investigators fully utilize the forensic implications of DeepSeek like the evidence that can be obtained and have a clear view of what can be recovered, thereby addressing the existing knowledge gap.