PatternMiner: A Hybrid Deep Learning Framework for Fragment Classification and Pattern Recognition in Digital Forensics

Abstract

The growing fragmentation of digital evidence in modern computing environments poses significant challenges for digital forensic analysis. Data is often deleted, overwritten, or distributed across heterogeneous platforms, limiting the effectiveness of traditional forensic tools that rely on intact files and deterministic rules. This work addresses a key limitation in current forensic methodologies: the scarcity of learning-based approaches capable of identifying patterns in fragmented and incomplete digital evidence. To address this challenge, we propose PatternMiner, a hybrid deep learning framework that integrates Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and Transformer encoders. The framework combines byte-level content fragments with contextual metadata, such as timestamps and file permissions, enabling multimodal inference from fragmented data while explicitly excluding label-derived features to prevent leakage. PatternMiner is evaluated on established forensic benchmark datasets, including Digital Corpora and AFF4 forensic containers, which simulate realistic fragmentation scenarios. All experiments are conducted under an explicit leakage-controlled evaluation protocol with group-aware data partitioning to ensure that performance reflects generalization to unseen data. Results show that the proposed framework achieves strong performance, with an accuracy of 92.1% and a macro-averaged F1-score of 92.1% under complete input conditions. Furthermore, the model demonstrates resilience to degraded and partially corrupted inputs, including truncation, byte removal, shifting, and fragment reordering. These findings indicate that PatternMiner effectively captures structural and contextual patterns in fragmented data, providing a practical step toward more reliable and data-driven forensic analysis. By combining multimodal learning with rigorous evaluation practices, the proposed framework contributes to developing scalable and generalizable solutions for modern digital forensic environments.

1. Introduction

The field of digital forensics has become progressively complex. Modern computing is no longer limited to a single device or operating system [1]; instead, digital interactions span diverse platforms [2], including personal computers, smartphones, cloud services, and interconnected network devices [3]. The resulting digital evidence proliferates significantly as users increasingly engage across these multiple environments [4]. However, this evidence is seldom complete or neatly organized; it is frequently fragmented, overwritten, or partially deleted, a condition typically known as fragmentation [5,6]. Fragmentation remains a persistent [5] and challenging obstacle for digital forensic investigations [7]. Files are often fragmented across non-contiguous storage blocks within a file system or partially lost due to user actions such as deletion or overwriting, or to system-level processes that reallocate storage space [8]. Networked computing environments further complicate matters by scattering logs and digital traces across multiple endpoints [9]. As a result, investigators frequently encounter digital artifacts that resemble fragmented shards, such as incomplete files, partial metadata [7], or isolated segments of activity logs [10]. Piecing together coherent interpretations from such fragmented evidence is akin to solving a puzzle without a reference picture, where several critical pieces are missing [2].

Traditional forensic tools often fall short in such contexts, which rely on full-file recovery or deterministic rule sets [5,7]. They struggle to make inferences from isolated or ambiguous fragments and fail to recognize subtle, context-dependent relationships. This limitation highlights the growing need for pattern recognition in file fragments. Rather than seeking exact matches or relying on rigid heuristics, pattern recognition methods aim to identify correlations, behaviors, or trends across fragmented inputs. For instance, repeated access to certain file types, unusual timestamp sequences, or metadata-content inconsistencies may all point toward malicious activity, even if the files are incomplete [11]. Figure 1 highlights the forensic challenge of mapping fragmented segments back to their original logical structure, underscoring the need for intelligent pattern recognition systems such as PatternMiner.

Figure 1. Illustration of file fragmentation and reconstruction across different states. (a) shows an original contiguous file layout consisting of labeled segments A through D. (b) represents a partially fragmented view where some segments are missing or overwritten, typical of deleted or tampered files. (c) depicts a reconstructed version with substituted or reallocated blocks, introducing new segments such as E, which is spurious or incorrectly inferred content resulting from fragmentation or reconstruction errors.

To address this need, this paper presents PatternMiner, a deep-learning-based system that infers forensic patterns from partial and fragmented digital evidence. PatternMiner does not rely on fully intact files or explicit signatures. Instead, it learns to associate content fragments with metadata attributes and temporal sequences, using architectures such as convolutional and recurrent neural networks. By doing so, it can make intelligent predictions about the origin, usage, or significance of fragments within a forensic context. PatternMiner’s goal is not to replace human judgment but to augment it, providing investigators with deeper, pattern-based insights where traditional tools offer little guidance. By learning from historical forensic data and modeling complex dependencies, PatternMiner represents a critical step forward in analyzing fragmented digital environments.

This paper introduces PatternMiner, a deep-learning-based system designed to extract patterns from incomplete and scattered digital evidence. At the heart of this research lies a key question: can machines learn to connect fragmented traces and reconstruct meaningful forensic narratives, as a seasoned investigator might? We explore this question by combining advances in deep learning, particularly Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), and Transformer models, with forensic knowledge to automate pattern recognition across fragmented data sources.

Pattern recognition in forensics is not merely about matching strings or identifying file signatures. It involves detecting behavioral footprints, correlating user actions, reconstructing timelines, and detecting anomalies or usage trends from incomplete artifacts. These patterns can manifest as repeated access to certain file types, time-of-day behaviors, or correlations between file metadata and content structures. Recognizing such patterns in fragmented digital evidence is significantly harder, as the data may be unordered, corrupted, or entirely missing. This fragmentation arises from several scenarios, including anti-forensic tactics such as file wiping and encryption, operating system file allocation mechanisms, and even natural disk wear and formatting.

Deep learning, with its ability to model nonlinear, high-dimensional relationships, offers a promising approach to tackling these challenges. Unlike rule-based systems or shallow machine learning models, deep networks can learn intricate dependencies and infer context even from partial data. Yet, applying deep learning effectively in the forensic domain remains an open challenge. Digital forensics presents unique challenges: small datasets, privacy constraints, diverse data modalities (including binary data, metadata, and logs), and the critical need for interpretability in legal contexts.

While prior work has explored machine learning in forensics, ranging from malware classification to anomaly detection, most assume access to coherent data inputs. Very few systems are explicitly designed to operate on fragmented evidence. Furthermore, pattern recognition efforts in digital forensics are often limited to handcrafted features or single-modal analysis. Little research has effectively leveraged deep architectures to unify fragmented content with metadata into a coherent framework for forensic reasoning. This gap becomes even more pronounced when considering non-contiguous, partially encrypted, or otherwise damaged evidence.

1.1. Contributions

This research addresses the challenge of analyzing fragmented and heterogeneous digital evidence by developing PatternMiner. Unlike conventional approaches that rely on complete data or single-model assumptions, the proposed framework is designed to capture multiple dependency structures commonly observed in fragmented forensic data. The main contributions of this paper are summarized as follows:

• Principled hybrid architecture design: We propose a hybrid deep learning framework that integrates complementary modeling components to capture local (CNN), sequential (LSTM), and global (Transformer) dependencies within fragmented digital evidence.
• Inductive bias decomposition for fragmented data: We present a conceptual formulation that decomposes forensic pattern recognition into three complementary components: local byte-level structure, contextual sequential relationships, and non-contiguous global dependencies, and associates each component with an appropriate neural modeling strategy.
• Multimodal representation of forensic evidence: We develop a unified encoding strategy that integrates raw byte-level content with contextual metadata (e.g., timestamps and permissions), enabling joint learning from structural and contextual forensic signals.
• Pattern recognition under incomplete and corrupted inputs: We demonstrate that combining complementary modeling components improves performance and generalization under fragmented and partially degraded conditions, including missing, disordered, truncated, shifted, and partially corrupted fragments.
• Comprehensive empirical evaluation and analysis: We provide an extensive evaluation of the proposed framework, including ablation studies and comparisons with traditional machine learning baselines, as well as analyses of each architectural component’s contribution to overall performance.

1.2. Paper Organization

The rest of the paper is structured as follows: Section 2 provides a detailed review of digital forensic fragmentation, pattern recognition techniques, and the use of deep learning in forensic contexts. Section 3 introduces the architecture of PatternMiner, including data representation, model choices, and training procedures. Section 4 discusses the dataset and implementation details. Section 5 presents experimental evaluations, including performance metrics, ablation studies, and comparisons with baselines. Section 6 discusses the implications, strengths, and limitations of the proposed approach. Section 7 outlines the conclusion and future directions.

2. Background and Related Work

As digital ecosystems become increasingly complex and distributed, digital forensics faces growing challenges in identifying, interpreting, and reconstructing evidence [12]. In many investigations, digital traces are incomplete, scattered, or intentionally obfuscated, requiring analysts to interpret fragmented data under time-sensitive conditions [13]. Traditional forensic tools, while effective in structured environments, often struggle with partial or tampered artifacts. Consequently, pattern recognition and machine learning techniques have been integrated into forensic workflows to enable more adaptive and intelligent analysis. This section outlines fragmentation and tampering in digital evidence, reviews advances in forensic pattern recognition, and examines recent deep learning approaches for fragmented data.

2.1. Digital Forensics and Fragmentation

Fragmented or tampered digital evidence poses significant challenges to forensic investigations, affecting the integrity and reliability of evidence in legal contexts [14]. Fragmentation occurs when data is incomplete or distributed across non-contiguous storage sectors due to deletion, overwriting, or system processes [15,16]. Tampering involves deliberate manipulation or concealment of data to mislead investigators.

Modern digital infrastructures further complicate reconstruction due to the scale and heterogeneity of storage environments. Missing or altered data can distort timelines and lead to inaccurate interpretations [17,18]. Fragmentation may arise across storage devices, cloud systems, or non-sequential disk blocks, requiring advanced recovery methods such as file carving [19].

Tampering is often reflected in altered metadata, falsified timestamps, or deleted logs. Detecting such behavior requires identifying deviations from expected data patterns, including anti-forensic techniques like wiping, encryption, or obfuscation [7]. Failure to detect tampering can compromise investigations and lead to incorrect conclusions.

These challenges are especially pronounced in cybercrime, insider threats, and mobile environments, where data may be distributed, encrypted, or inconsistently stored. Mobile systems, in particular, introduce additional fragmentation due to app-specific storage and synchronization behaviors.

2.2. Pattern Recognition in Forensics

The increasing volume of digital evidence has elevated the importance of pattern recognition in forensic analysis [20]. By leveraging machine learning, data mining, and computer vision, pattern recognition enables investigators to identify meaningful structures within large datasets [21]. These patterns may reveal behaviors, identities, or relationships critical to investigations.

Recent work has demonstrated the benefits of AI-driven forensic analysis. Iyengar et al. [20] proposed an identity-ranking algorithm based on expert knowledge, though it is limited to metadata and logical files. Odeh et al. [8] combined memory forensics with a large language model to detect ransomware, demonstrating AI’s effectiveness in distinguishing malicious activity. Bergmann et al. [22] applied pattern recognition to physical forensics via infrared spectral analysis, highlighting its cross-domain applicability. Arthanari [23] emphasized the broader impact of AI in improving forensic accuracy and efficiency while raising concerns about bias, transparency, and privacy.

Recent advances in data-driven pattern recognition have demonstrated the effectiveness of deep learning and machine learning techniques across diverse domains, including environmental monitoring and digital forensics. In the context of wildfire detection, robust monitoring under varying environmental conditions remains a significant challenge. Although dual-modal approaches that combine Optical (RGB) and Thermal Infrared (TIR) imagery have improved segmentation performance, they often struggle to suppress modal noise in complex scenarios (e.g., light reflections) and fail to achieve precise boundary reconstruction due to the absence of explicit physical guidance. To address these limitations, [24] proposed the Thermodynamic Prior-Guided Transformer (TPFormer), an end-to-end segmentation framework that integrates thermodynamic priors into the learning process. The model incorporates a Hybrid Attention Fusion Module to enhance cross-modal feature calibration and suppress non-thermal interference, alongside a TIR-Prior Gated Decoder that leverages thermal radiation intensity to guide feature reconstruction. Experimental results demonstrate that TPFormer achieves superior performance on benchmark datasets, attaining 79.72% Intersection over Union (IoU) and 88.72% F1-score, outperforming prior methods such as RTFNet and RegionNet. These findings highlight the importance of integrating domain-specific priors and multimodal learning for improving robustness in complex environments.

In digital forensics, File Type Identification (FTI) represents a fundamental task for applications such as malware detection, network security, and forensic investigation. Traditional approaches have relied on statistical feature extraction techniques, among which n-gram analysis has gained significant attention for its ability to capture byte-level patterns in file fragments. As discussed in [25], n-gram-based methods have been successfully combined with machine learning classifiers, including Support Vector Machines (SVMs) and Neural Networks (NNs), to improve classification performance. However, the literature remains limited in providing comprehensive analyses of how key parameters, such as n-gram size, learning rate, and feature dimensionality, affect model performance. Furthermore, comparative studies evaluating the scalability and efficiency of different classifiers are relatively scarce. To address these gaps, ref. [25] conducted a systematic comparison of multiple SVM and NN configurations using the RealDC dataset. Their findings indicate that SVM-based approaches generally outperform neural networks in terms of classification accuracy, although scalability remains a challenge for large-scale applications.

These studies illustrate the growing role of machine learning and deep learning in extracting meaningful patterns from complex and fragmented data. While domain-specific approaches, such as thermodynamic priors in wildfire detection, demonstrate the benefits of incorporating contextual knowledge, forensic applications continue to rely heavily on statistical features and classical machine learning models. This highlights the need for more advanced, multimodal, and context-aware learning frameworks capable of handling fragmented and heterogeneous data in forensic environments.

Also, recent work has explored the use of hybrid deep learning architectures for classifying file fragments in digital forensics. For instance, Toma et al. [26] propose a multi-task, hybrid deep learning framework to improve robustness for fragment classification tasks. Their approach leverages multiple learning objectives to enhance feature representation and classification performance across fragmented inputs. While the method demonstrates promising results in handling fragmented data, it primarily focuses on content-based classification and does not explicitly incorporate multimodal contextual information, such as metadata, which can provide additional forensic cues. This highlights the ongoing need for more comprehensive frameworks that integrate heterogeneous data sources for improved forensic pattern recognition.

While the framework proposed by Toma et al. [26] shares certain architectural similarities with PatternMiner, including the use of CNN and LSTM components for learning fragment representations, several important methodological differences distinguish the two approaches.

First, the approach of Toma et al. focuses primarily on byte-level fragment categorization using a hybrid CNN–LSTM architecture augmented with attention mechanisms and multi-task learning. Their framework is designed to improve latent feature extraction and classification robustness from raw byte sequences under noisy conditions. In contrast, PatternMiner adopts an explicitly multimodal forensic learning strategy that integrates both byte-level content fragments and contextual metadata, including timestamps, file sizes, and permission indicators. This multimodal formulation enables the proposed framework to jointly reason over structural and contextual forensic signals rather than relying solely on content-based representations.

Second, the attention mechanism in Toma et al. primarily enhances sequential feature weighting within the fragment representation pipeline. PatternMiner extends this capability through Transformer-based global dependency modeling, designed specifically to capture relationships across fragmented, non-contiguous forensic evidence. This distinction is particularly important in forensic environments where logically related fragments may be physically separated, reordered, partially overwritten, or distributed across heterogeneous storage structures.

Third, the evaluation methodologies differ substantially. Toma et al. evaluate their framework using 5505 fragments derived from 16 GovDocs1 subsets with 28 file categories. In contrast, PatternMiner is evaluated using both Digital Corpora disk images and AFF4 forensic containers under a leakage-aware protocol that incorporates source-level group partitioning and corruption-aware testing scenarios. The proposed framework additionally evaluates robustness under byte removal, truncation, byte shifting, and out-of-order fragment arrangements to simulate realistic forensic degradation conditions.

Furthermore, PatternMiner explicitly incorporates leakage-prevention mechanisms, including metadata sanitization and source-level partitioning, to avoid cross-set contamination and trivial class inference. These safeguards are particularly important in forensic machine learning settings where hidden correlations or shared file origins may artificially inflate reported performance.

Table 1 summarizes the primary differences between the framework of Toma et al. [26] and the proposed PatternMiner architecture.

Table 1. Comparison between Toma et al. [26] and PatternMiner.

Aspect	Toma et al. [26]	PatternMiner
Primary Input	Byte-level fragments only	Byte-level fragments + metadata
Architecture	CNN + LSTM + Attention	CNN + LSTM + Transformer
Learning Strategy	Multi-task learning + generative modeling	Multimodal hybrid representation learning
Fragment Length	4096 bytes	512 bytes
Metadata Integration	No	Yes
Global Dependency Modeling	Limited attention-based weighting	Transformer-based global context modeling
Leakage Prevention	Not explicitly discussed	Explicit metadata sanitization and group-aware partitioning
Corruption Simulation	Limited discussion	Byte removal, truncation, shifting, and reordering
Datasets	GovDocs1 subsets	Digital Corpora + AFF4
Evaluation Focus	Fragment categorization	Fragment classification and forensic pattern recognition

Overall, both approaches demonstrate the effectiveness of hybrid deep learning architectures for fragmented forensic analysis. However, PatternMiner extends prior work through multimodal forensic reasoning, Transformer-based global dependency modeling, and a leakage-aware evaluation framework specifically designed for fragmented and heterogeneous forensic environments.

Existing literature reviews [17] often lack depth, focusing on definitions rather than empirical insights, and rarely address practical forensic challenges or ethical implications. Additionally, most existing approaches either rely solely on metadata, target specific domains, or assume complete data availability.

To address these limitations, PatternMiner introduces a hybrid deep learning framework that integrates convolutional, recurrent, and attention-based models. Jointly analyzing metadata and byte-level content enables robust pattern recognition in fragmented and incomplete forensic data, overcoming key limitations of prior work.

Recent advances in deep learning have demonstrated the effectiveness of Transformer-based models in capturing long-range dependencies across sequential data. In particular, transformer-only architectures have been widely adopted in domains such as natural language processing and multimodal learning due to their ability to model global contextual relationships through self-attention mechanisms.

Table 2 compares PatternMiner with prior forensic pattern recognition approaches.

Table 2. Comparison of prior forensic pattern recognition approaches.

Reference	Modality Handled	Fragmentation-Aware	Model Type	Performance Metrics	Key Limitations
[20]	Metadata only	No	Rule-based, heuristic	Not reported	Limited to logical files; no content-level insight
[8]	Content (memory dumps)	Yes	Deep Learning (LLaMA-7B)	Precision ≈ 88%	Specific to ransomware; metadata not used
[22]	Physical (IR spectra)	No	Rule-based, cross-correlation	Improved accuracy (qualitative)	Non-digital context; not applicable to content fragmentation
[23]	Mixed forensic domains	No	General AI survey	Qualitative	High-level review; lacks implementation or benchmarking
[25]	Content (byte-level fragments)	Partial	ML (SVM, NN with n-grams)	Accuracy-based comparison (dataset-dependent)	Limited scalability; lacks deep multimodal modeling
[24]	Multimodal (RGB + TIR imagery)	No	Hybrid DL (CNN + Transformer)	IoU: 79.72%, F1: 88.72%	Not designed for forensic data; no fragmentation handling
[26]	Content (byte-level fragments)	Yes	Hybrid DL (multi-task learning)	Improved classification accuracy (reported)	Content-only modeling; lacks metadata integration and multimodal reasoning
PatternMiner (the proposed)	Content + Metadata	Yes	Hybrid DL (CNN + LSTM + Transformer)	Accuracy: 92.1%, F1: 92.1%	Interpretability under development

However, the direct application of transformer-only models to fragmented digital forensic data presents several limitations. First, Transformers typically require large-scale training data to implicitly learn structural patterns such as locality and sequential ordering. In forensic contexts, such large annotated datasets are often unavailable due to privacy, legal, and operational constraints. Second, transformer-only architectures lack explicit inductive biases for modeling low-level byte structures, which are critical for identifying file signatures and format-specific patterns in raw binary data. Third, their computational complexity may limit their practicality in resource-constrained forensic environments.

In contrast, the proposed PatternMiner architecture explicitly encodes complementary inductive biases through a hybrid design. CNN layers provide a strong locality bias for capturing byte-level structures, LSTM layers model temporal dependencies within metadata, and Transformer encoders capture global relationships across disjoint fragments. This explicit decomposition reduces reliance on large datasets and improves robustness in fragmented, noisy conditions.

To further clarify the differences among architectural paradigms, Table 3 summarizes the strengths and limitations of the transformer-only, CNN-LSTM, and proposed hybrid approaches.

Table 3. Comparison of architectural paradigms for fragmented forensic pattern recognition.

Model Type	Strengths	Limitations
Transformer-only	Strong global context modeling; effective for long-range dependencies	Requires large-scale data; lacks explicit locality bias; computationally intensive
CNN + LSTM	Captures local patterns and sequential dependencies; efficient with smaller datasets	Limited ability to model non-contiguous global relationships across fragments
Proposed (PatternMiner)	Simultaneously captures local, sequential, and global dependencies; robust to fragmentation and missing data	Higher architectural complexity; increased computational requirements compared to shallow models

Overall, while transformer-only models provide strong global modeling capabilities, the proposed hybrid architecture offers a more balanced and task-specific solution for fragmented forensic data by explicitly incorporating multiple complementary inductive biases. This design choice is particularly advantageous in scenarios with limited data availability and high degrees of fragmentation, where relying solely on implicit learning may be insufficient.

3. System Architecture and Methodology

PatternMiner, as illustrated in Figure 2, is a deep learning-based forensic framework designed to identify and reconstruct meaningful patterns from fragmented digital evidence. The framework is structured into four primary components: (1) an input interface for acquiring fragmented content and associated metadata, (2) a feature encoding layer that transforms raw inputs into structured representations, (3) a hybrid deep learning engine that performs multimodal feature learning, and (4) an output module responsible for fragment classification and pattern inference.

Figure 2. Architecture of PatternMiner.

The proposed model operates at the level of individual fragments and does not attempt to reconstruct complete files. Specifically, it does not perform fragment grouping, ordering, or structural recovery. Instead, it focuses on extracting discriminative features and classifying fragments, which can serve as inputs to higher-level reconstruction pipelines.

The system operates on two complementary input modalities:

• Metadata: Temporal and structural attributes, including access and modification timestamps, file size, and permission indicators.
• Content fragments: Raw byte sequences extracted from partial, corrupted, or disjoint file segments.

Leakage Prevention Principle: To ensure the validity of the experimental evaluation, any attribute that directly encodes the prediction target is strictly excluded from the input representation. In particular, the file type, used as the ground-truth label, is not included in the metadata or feature-encoding process. This design prevents trivial learning and ensures that the model relies solely on the data’s intrinsic structural and contextual characteristics.

Dedicated encoders process metadata and content streams independently to preserve modality-specific characteristics. The resulting representations are subsequently fused and passed to a hybrid neural architecture that integrates convolutional, recurrent, and attention-based mechanisms. This design enables the model to capture local byte-level structures, sequential dependencies, and global contextual relationships across fragmented inputs. The final output layer produces predicted fragment classes or reconstruction likelihoods.

3.1. Data Representation

Effective learning from fragmented digital evidence requires a representation that captures both structural content and contextual metadata. PatternMiner adopts a dual-stream representation strategy in which metadata and content are modeled as complementary yet distinct modalities.

3.1.1. Metadata Encoding

Metadata features are encoded into a fixed-length vector:

$$\mathbf{m}=[t_a,t_m,s,\mathbf{p}]$$

(1)

where:

• $t_a$ denotes the normalized last access timestamp;
• $t_m$ denotes the normalized last modification timestamp;
• s represents the normalized file size;
• $\mathbf{p}$ is a binary-encoded permission vector (e.g., read, write, execute).

All numerical metadata attributes are normalized to ensure scale consistency and stable model convergence during training.

File type information is explicitly excluded from the metadata representation, as it constitutes the prediction target. Including such information would introduce label leakage and artificially inflate performance. By restricting metadata to non-label attributes, the model is compelled to learn meaningful forensic patterns from intrinsic properties of the data rather than exploiting trivial correlations.

3.1.2. Content Encoding

Each content fragment is represented as a sequence of raw bytes $(b_1,b_2,\dots ,b_n)$, where $b_i\in 0,\dots ,255$. To enable effective learning, these discrete byte values are mapped into a continuous embedding space:

$$\mathbf{c}=\mathrm{Embed}(b_1,b_2,\dots ,b_n),\mathbf{c}\in {\mathbb{R}}^{n\times d}$$

(2)

This embedding captures semantic relationships between byte patterns while preserving structural information inherent in file fragments.

To further extract localized structural features, such as file signatures, headers, and format-specific byte sequences, one-dimensional convolutional operations are applied:

$${\mathbf{c}}^{\prime }=\mathrm{Conv}1\mathrm{D}\left(\mathbf{c}\right)$$

(3)

These convolutional transformations enable the model to identify meaningful low-level patterns critical to forensic reconstruction tasks.

3.1.3. Combined Input Representation

The final input representation is constructed by integrating metadata and content-derived features:

$$\mathbf{x}=[\mathbf{m}\Vert \mathrm{Flatten}\left({\mathbf{c}}^{\prime }\right)]$$

(4)

Flattening the content representation ensures dimensional compatibility with the metadata vector while preserving learned structural features.

The combined representation strictly excludes any label-derived attributes (e.g., file type). This guarantees that the model learns from intrinsic structural and contextual signals rather than relying on explicit class identifiers.

Fusion Strategy Rationale

The proposed framework employs direct feature concatenation to integrate metadata and byte-level content representations. Although more sophisticated multimodal fusion mechanisms, such as cross-attention fusion or gated fusion networks, have been proposed in other domains, direct concatenation was intentionally adopted in this work for both methodological and forensic-specific reasons.

First, the two modalities considered in PatternMiner exhibit fundamentally different structural characteristics. Byte-level fragment embeddings represent high-dimensional local content structures, whereas metadata features correspond to low-dimensional contextual forensic attributes such as timestamps, file size, and permissions. Direct concatenation preserves the independence of these heterogeneous modalities while enabling subsequent network layers to learn complementary relationships without imposing strong assumptions regarding modality interaction.

Second, fragmented forensic environments frequently involve incomplete, noisy, or partially corrupted evidence. Under such conditions, complex fusion strategies may overfit spurious correlations between modalities, particularly when training data is limited. In contrast, concatenation provides a comparatively stable and robust integration mechanism that reduces the risk of over-parameterization and preserves model generalization under degraded forensic conditions.

Third, the primary objective of the proposed architecture is to investigate the complementary inductive biases introduced by the CNN, LSTM, and Transformer components. Employing a simple, interpretable fusion mechanism helps isolate the contributions of these architectural components without introducing additional confounding factors from highly parameterized fusion modules.

The advanced fusion mechanisms, including cross-attention fusion, gated multimodal fusion, and hierarchical interaction modeling, may further improve representation learning in complex forensic environments. Investigating such approaches constitutes an important direction for future work.

3.2. Model Selection

PatternMiner employs a hybrid neural architecture that integrates CNNs, LSTM networks, and Transformer encoders. This design is motivated by the heterogeneous and fragmented nature of forensic data, which requires simultaneous modeling of local structures, sequential dependencies, and global contextual relationships.

To improve domain adaptability, the architecture is pretrained on synthetically generated fragmented data and subsequently fine-tuned on real-world forensic datasets, including Digital Corpora and AFF4. This two-stage training strategy enables the model to generalize across diverse fragmentation patterns and noise conditions.

Pretraining is performed on synthetically generated, fragmented data to improve the model’s ability to learn general structural patterns before fine-tuning on real forensic datasets. The synthetic dataset is constructed by applying controlled fragmentation operations to source files, including random truncation, byte removal, shifting, and out-of-order rearrangement. These transformations simulate realistic corruption and fragmentation scenarios encountered in forensic analysis.

The resulting synthetic dataset consists of approximately 30,000 fragment samples of fixed length (512 bytes), generated by the AFF4-based pipeline described in Section 4.1. This pretraining stage enables the model to capture generalizable byte-level and structural features before being adapted to real-world forensic data.

Explicit-Leakage-Controlled Design Principle: As depicted in Algorithm 1, all components of the architecture operate on input representations that exclude any features directly encoding the prediction target. This ensures that performance gains reflect genuine pattern learning rather than trivial correlations.

• CNNs: CNNs extract localized spatial patterns from byte-level representations. These include structural signatures such as headers, compression markers, and encoding artifacts. Given an input $\mathbf{x}$, convolutional feature extraction is defined as:

  $${\mathbf{h}}_{\mathrm{CNN}}=\mathrm{ReLU}\left(\mathrm{Conv}1\mathrm{D}(\mathbf{x};{\mathbf{W}}_c,{\mathbf{b}}_c)\right)$$

  (5)
  This operation captures fine-grained patterns that are essential for distinguishing between fragment types.
• (LSTMs): The LSTM component is used to model ordered dependencies within the combined fragment representation rather than long-horizon temporal event sequences across multiple forensic artifacts. In the proposed framework, each sample consists of a single content fragment together with its associated metadata attributes. Consequently, the LSTM operates on the sequential structure of the encoded feature representation, capturing dependencies among embedded byte-level and metadata-derived patterns.
  More specifically, the LSTM processes the ordered latent feature embeddings generated after content encoding and feature fusion, thereby preserving contextual relationships across neighboring dimensions of the representation. This mechanism improves the modeling of structured dependencies that may not be fully captured by convolutional filters alone.
  Formally, the recurrent representation is computed as:

  $$h_t=\mathrm{LSTM}(x_t,h_{t-1},c_{t-1})$$

  (6)

  where $x_t$ denotes the sequentially processed latent feature vector at step t, while $h_{t-1}$ and $c_{t-1}$ represent the hidden and cell states, respectively.
  Importantly, the proposed framework does not model full forensic event timelines or multi-fragment temporal sessions. Instead, the LSTM component serves as an intermediate learner of sequential dependencies within the hybrid representation pipeline.
• Transformer Encoder: Transformer encoders capture long-range dependencies and global relationships across fragmented and multimodal inputs. The self-attention mechanism dynamically weighs the importance of different features:

  $$\mathrm{Attention}(Q,K,V)=\mathrm{softmax}\left({\displaystyle \frac{Q{K}^{\top }}{\sqrt{d_k}}}\right)V$$

  (7)

  where:

  $$Q=\mathbf{x}{W}_Q,K=\mathbf{x}{W}_K,V=\mathbf{x}{W}_V$$
  This allows the model to reason across disjoint fragments and heterogeneous feature spaces.

The outputs of these components are fused into a unified representation, enabling the model to jointly leverage local, sequential, and global information. Pretraining followed by fine-tuning further enhances generalization and robustness under realistic forensic conditions.

Pretraining Configuration

The pretraining stage was designed to initialize the hybrid architecture with generalizable structural representations prior to adaptation on real forensic datasets. Pretraining was conducted using approximately 30,000 synthetically generated fragment samples derived from the AFF4-based fragmentation pipeline. Each fragment consisted of 512-byte content segments accompanied by normalized metadata attributes.

The synthetic pretraining dataset incorporated multiple fragmentation and corruption operations, including random byte removal, truncation, byte shifting, and out-of-order fragment arrangements, to expose the model to diverse degradation patterns commonly encountered in forensic environments.

During pretraining, the model was optimized for 20 epochs using the Adam optimizer with a learning rate of $1\times {10}^{-4}$ and a batch size of 64. Early stopping was applied based on validation loss, with a patience threshold of 5 epochs, to mitigate overfitting. Dropout and batch normalization were additionally employed throughout training for regularization and stabilization.

Following pretraining, the learned parameters were used to initialize the PatternMiner framework prior to fine-tuning on the real-world Digital Corpora and AFF4 forensic datasets. Fine-tuning was subsequently performed using the group-aware partitioning strategy to ensure evaluation on previously unseen forensic sources.

Algorithm 1 PatternMiner: Explicit-Leakage-Controlled Hybrid Deep Learning Pipeline

Require: Fragmented dataset $\mathcal{D}={(F_i,M_i,y_i,g_i)}_{i=1}^N$ where $F_i$ is the content fragment, $M_i$ is metadata, $y_i$ is the ground truth label, and $g_i$ is the group identifier (file or disk source) Ensure: Predicted class probabilities ${\widehat{y}}_i$   1: Preprocessing:   2: for each $(F_i,M_i)\in \mathcal{D}$ do   3:       Normalize numerical metadata (timestamps, size) to $[0,1]$   4:       Encode non-label categorical features (permissions only)   5:       Exclude any label-derived attributes (e.g., file type)   6:       Pad or truncate $F_i$ to fixed length (e.g., 512 bytes)   7:       Embed byte sequence: $${\mathbf{c}}_i=\mathrm{Embed}\left(F_i\right),{\mathbf{c}}_i\in {\mathbb{R}}^{512\times d}$$   8:       Construct input: $${\mathbf{x}}_i=[M_i\Vert \mathrm{Flatten}\left({\mathbf{c}}_i\right)]$$   9: end for 10: Group-Aware Data Partitioning: 11: Split dataset into training, validation, and test sets based on $g_i$ 12: Ensure all fragments from the same group remain within a single split 13: Feature Extraction: 14: for each ${\mathbf{x}}_i$ do 15:       ${\mathbf{h}}_i^{\mathrm{cnn}}=\mathrm{ReLU}\left(\mathrm{Conv}1\mathrm{D}\left({\mathbf{x}}_i\right)\right)$ 16:       ${\mathbf{h}}_i^{\mathrm{lstm}}=\mathrm{LSTM}\left({\mathbf{x}}_i\right)$ 17:       Compute attention: $$Q={\mathbf{x}}_i{W}_Q,K={\mathbf{x}}_i{W}_K,V={\mathbf{x}}_i{W}_V$$ $${\mathbf{h}}_i^{\mathrm{trans}}=\mathrm{softmax}\left({\displaystyle \frac{Q{K}^{\top }}{\sqrt{d_k}}}\right)V$$ 18:       Fuse representations: $${\mathbf{h}}_i=[{\mathbf{h}}_i^{\mathrm{cnn}}\Vert {\mathbf{h}}_i^{\mathrm{lstm}}\Vert {\mathbf{h}}_i^{\mathrm{trans}}]$$ 19: end for 20: Training and Inference: 21: Initialize model parameters (pretrained) 22: Optimize using Adam to minimize categorical cross-entropy: $$\mathcal{L}=-\sum y_{i}log\left({\widehat{y}}_i\right)$$ 23: Apply early stopping based on validation performance 24: return predicted probabilities ${\widehat{y}}_i$

3.3. Architectural Rationale and Theoretical Justification

The design of the proposed PatternMiner architecture is guided by the intrinsic structural properties of fragmented digital evidence, rather than by an empirical combination of existing deep learning components. Unlike conventional machine learning settings, where inputs are typically complete, well-structured, and independently distributed, digital forensic data is inherently incomplete, disordered, and heterogeneous. These characteristics necessitate a modeling strategy that explicitly captures multiple forms of dependency without relying on explicit identifiers or label-derived features.

In this section, we provide a principled justification for the hybrid integration of CNNs, LSTM networks, and Transformer encoders. The architecture is designed to decompose the learning problem into complementary inductive biases that align with the underlying structure of fragmented forensic data.

3.3.1. Structural Characteristics of Fragmented Forensic Data

Fragmented digital evidence exhibits several fundamental properties that distinguish it from standard machine learning inputs:

• Local Structural Patterns: Digital files contain low-level byte signatures such as headers, magic numbers, delimiters, and compression markers. These patterns are localized within short contiguous regions and provide intrinsic structural cues independent of explicit class labels.
• Sequential Dependency Structures: Metadata attributes and embedded feature representations exhibit ordered structural relationships that may provide contextual information relevant to fragment classification. Although the proposed framework does not model complete forensic timelines across multiple artifacts, preserving ordered dependencies within latent representations remains beneficial for capturing contextual correlations between content-derived and metadata-derived features.
• Non-Contiguous Global Relationships: In fragmented storage environments, logically related data segments may be physically separated, reordered, or partially missing. This introduces long-range dependencies across disjoint fragments, requiring global context modeling beyond local or sequential proximity.

These characteristics imply that fragmented forensic data cannot be effectively modeled using a single inductive bias. Instead, a multi-perspective modeling approach is required to simultaneously capture local structure, temporal evolution, and global context.

3.3.2. Limitations of Single-Model Approaches

Single-model architectures are insufficient to capture the full complexity of fragmented forensic data:

• CNN-based models are limited to local feature extraction and cannot model temporal or long-range dependencies across disjoint fragments.
• LSTM-based models are effective for sequential reasoning but assume ordered inputs and struggle with non-contiguous or irregularly structured data.
• Transformer-based models, while powerful for capturing global dependencies, typically require large-scale datasets to implicitly learn locality and fine-grained structural patterns. In forensic settings, where data is limited and noisy, this can lead to suboptimal learning of byte-level structures.

More importantly, reliance on a single modeling paradigm increases the risk of overfitting to superficial correlations, particularly in constrained forensic datasets. Without explicit inductive biases, models may learn dataset-specific shortcuts rather than robust, generalizable forensic patterns.

3.3.3. Inductive Bias Decomposition and Hybrid Design

PatternMiner explicitly decomposes the learning process into three complementary inductive biases, each implemented by a specialized neural component:

• CNN for Local Pattern Extraction: CNN layers introduce a strong locality bias, enabling the detection of short-range, position-invariant patterns in byte sequences. This is critical for identifying structural signatures such as file headers and encoding markers.
• LSTM for Sequential Modeling: LSTM networks capture temporal dependencies within metadata and ordered signals. Their gated memory mechanism enables the retention of relevant contextual information across time steps, facilitating temporal reasoning in fragmented datasets.
• Transformer for Global Context Modeling: Transformer encoders employ self-attention mechanisms to model long-range dependencies across non-contiguous inputs. This allows the model to infer relationships between disjoint fragments and heterogeneous features.

Formally, let the input be represented as:

$$\mathbf{x}=[\mathbf{m}\Vert \mathbf{c}]$$

(8)

where $\mathbf{m}$ denotes metadata features (excluding any label-derived attributes) and $\mathbf{c}$ represents byte-level content embeddings.

The hybrid model learns a composite representation:

$$\mathbf{h}=f_{\mathrm{CNN}}\left(\mathbf{x}\right)\Vert f_{\mathrm{LSTM}}\left(\mathbf{x}\right)\Vert f_{\mathrm{Transformer}}\left(\mathbf{x}\right)$$

(9)

This fusion enables the model to capture complementary feature spaces corresponding to local structure, temporal dynamics, and global context. Importantly, predictions are derived from intrinsic structural and contextual patterns rather than explicit identifiers or label-derived inputs.

3.3.4. Collaborative Local-Sequential-Global Modeling

The proposed hybrid architecture is designed to model fragmented forensic evidence through a hierarchical decomposition of complementary dependency structures. Rather than operating as independent feature extractors, the CNN, LSTM, and Transformer components collaboratively capture different aspects of fragmented digital artifacts under incomplete and corrupted conditions. Figure 3 illustrates the operational workflow of the proposed architecture.

Figure 3. The Operational Workflow of PatternMiner.

At the first stage, the CNN component processes byte-level fragment embeddings to capture localized structural signatures. These local patterns include file headers, encoding markers, compression signatures, delimiter structures, and short-range byte dependencies that frequently remain partially preserved even in fragmented or corrupted forensic artifacts. Because fragmentation often destroys global structure while preserving short contiguous regions, CNN-based locality modeling provides robust low-level forensic cues.

The extracted local representations are subsequently processed alongside metadata-derived contextual signals using the LSTM component. The LSTM models sequential and temporal relationships in forensic metadata, including access patterns, modification sequences, and contextual ordering. This stage enables the framework to preserve contextual continuity across partially disordered evidence and capture behavioral dependencies that cannot be inferred from byte content alone.

Finally, the Transformer encoder operates on the fused representations to model long-range and non-contiguous dependencies across fragmented inputs. In practical forensic environments, logically related fragments may be physically separated, reordered, partially overwritten, or distributed across heterogeneous storage locations. The self-attention mechanism enables the Transformer component to dynamically associate distant structural and contextual patterns, thereby reconstructing higher-level forensic relationships that extend beyond local sequential neighborhoods.

The collaborative interaction among these components enables the architecture to progressively transition from local structural analysis to sequential contextual reasoning and finally to global dependency modeling. This hierarchical processing strategy is particularly well-suited for fragmented forensic environments in which complete structural continuity is unavailable and meaningful evidence must be inferred from incomplete, noisy, and distributed artifact representations.

Importantly, the three components address complementary failure modes commonly encountered in fragmented forensic analysis:

• CNN layers mitigate the loss of global continuity by focusing on preserved local signatures;
• LSTM layers preserve temporal and contextual relationships under partial disorder;
• Transformer layers recover non-local dependencies across disjoint fragments.

This collaborative decomposition provides a principled mechanism for modeling fragmented forensic evidence across multiple dependency scales simultaneously.

3.3.5. Novelty of the Proposed Integration

Although the proposed framework incorporates established deep learning components, including CNNs, LSTMs, Transformers, and multimodal representation learning modules, the contribution of PatternMiner does not lie in merely introducing these architectures. Instead, the novelty lies in the forensic-specific integration strategy that systematically aligns these components with the structural, contextual, and fragmentation-related characteristics of digital forensic evidence.

The proposed integration is motivated by the observation that fragmented forensic artifacts exhibit multiple dependency scales simultaneously. In practical forensic environments, evidence fragments are rarely preserved as clean, contiguous byte streams. Instead, investigators frequently encounter partially overwritten sectors, truncated records, reordered storage blocks, fragmented compressed archives, and heterogeneous evidence distributed across multiple storage regions. Under such conditions, meaningful forensic interpretation requires simultaneous reasoning over:

• Localized byte-level structural signatures;
• Sequential contextual relationships;
• Long-range non-contiguous dependencies.

Traditional forensic machine learning approaches often focus on only one of these dependency scales. For example, statistical classifiers based on byte-frequency analysis or entropy estimation primarily capture coarse local distributions but ignore contextual ordering relationships. CNN-based fragment classifiers improve local structural extraction but remain limited in modeling long-range relationships across disjoint fragments. Sequential models such as LSTMs preserve ordering information but struggle to efficiently associate distant forensic structures amid severe fragmentation. Similarly, standalone Transformer architectures may model global dependencies effectively but often lack the strong inductive locality biases necessary for stable low-level byte-signature extraction in highly corrupted forensic environments.

PatternMiner addresses these limitations by explicitly decomposing fragmented forensic reasoning into complementary local, sequential, and global modeling stages.

At the first stage, the CNN component operates as a localized structural signature extractor. The convolutional filters learn short-range byte dependencies corresponding to file headers, compression markers, delimiters, encoding structures, executable signatures, and residual formatting artifacts that frequently persist even after fragmentation or partial corruption. This stage is particularly important because fragmentation typically destroys global continuity while preserving short contiguous byte neighborhoods. The CNN, therefore, establishes robust low-level forensic representations that remain resilient to moderate corruption and truncation.

The extracted local representations are subsequently processed by the LSTM component together with contextual metadata embeddings. Unlike conventional sequence modeling tasks that rely exclusively on temporal ordering, the LSTM stage in PatternMiner models forensic contextual continuity. This includes relationships associated with timestamp evolution, access behavior, modification patterns, storage ordering, and fragment adjacency characteristics. The recurrent architecture enables the framework to preserve sequential dependencies under partially disordered evidence conditions and recover contextual transitions that may not be recoverable from isolated fragment content alone.

The Transformer encoder then operates on the fused representations to capture long-range and non-contiguous dependencies across fragmented evidence. This stage is particularly significant in forensic environments because logically related fragments are frequently split across storage sectors, reordered by filesystem allocation behavior, or partially interleaved with unrelated data. Through self-attention mechanisms, the Transformer dynamically associates distant structural and contextual representations without assuming strict locality or sequential continuity. Consequently, the framework can infer higher-level forensic relationships that extend beyond immediate fragment neighborhoods.

The novelty, therefore, arises not from the independent use of CNNs, LSTMs, or Transformers, but from their coordinated forensic-oriented interaction under fragmentation-aware conditions. The architecture establishes a hierarchical reasoning pipeline that progressively transitions from:

$$\mathrm{Local}\mathrm{Structural}\mathrm{Modeling}\to \mathrm{Sequential}\mathrm{Contextual}\mathrm{Modeling}\to \mathrm{Global}\mathrm{Dependency}\mathrm{Modeling}$$

This progression directly mirrors the inferential workflow commonly encountered in digital forensic investigations, where investigators first identify residual local signatures, then reconstruct contextual relationships, and finally infer broader correlations among evidence across distributed artifacts.

Furthermore, PatternMiner extends prior hybrid forensic models through several methodological innovations specifically designed for forensic validity and generalization:

• Leakage-aware learning protocol: Explicit removal of label-derived metadata, automated leakage auditing, and source-level group-aware partitioning are incorporated to prevent trivial class inference and cross-set contamination.
• Multimodal forensic reasoning: Unlike content-only fragment classifiers, PatternMiner jointly models byte-level fragment structures and contextual forensic metadata, enabling integration of both structural and behavioral evidence signals.
• Fragmentation-aware robustness modeling: The framework is evaluated under multiple degradation scenarios, including truncation, byte removal, shifting, and fragment disordering, to simulate realistic forensic recovery conditions.
• Generalizable forensic representation learning: Synthetic pretraining on fragmented AFF4-derived data enables the model to learn transferable structural priors prior to adaptation on real-world forensic datasets.

Importantly, the proposed framework should not be interpreted as a generic multimodal deep learning pipeline applied to forensic data. Rather, the architecture, training protocol, corruption modeling strategy, and evaluation methodology are jointly designed around the operational constraints of fragmented forensic analysis. The resulting contribution is therefore a forensic-oriented representation-learning framework specifically optimized for environments with incomplete, corrupted, heterogeneous, and non-contiguous digital evidence.

Compared with existing hybrid fragment-classification approaches, PatternMiner extends the problem formulation from isolated fragment categorization toward structured forensic pattern recognition under realistic fragmentation and contamination constraints. This distinction is particularly important in operational digital forensic workflows, where evidence interpretation frequently depends not only on the fragment’s content but also on contextual relationships, source integrity, temporal behavior, and structural coherence across fragments.

3.3.6. Implications for Fragmented Forensic Analysis

The proposed hybrid architecture is particularly well-suited for forensic scenarios characterized by incomplete, noisy, or adversarially manipulated data. By explicitly modeling multiple forms of dependency, the system remains robust even when certain modalities, such as metadata or content, are partially missing or degraded.

Furthermore, the architecture supports generalization across diverse forensic contexts by avoiding reliance on dataset-specific shortcuts or label leakage. Instead, it learns transferable representations grounded in the inherent structure of digital artifacts.

The contribution of PatternMiner lies in the principled integration of complementary inductive biases tailored to fragmented digital evidence. This design provides both a theoretical foundation and a practical framework for robust, generalizable, and explicit-leakage-controlled forensic pattern recognition.

3.4. Training Procedure

This section describes the training methodology used to develop and evaluate the PatternMiner framework, including dataset preparation, preprocessing, training configuration, and loss formulation. The pipeline is designed to reflect real-world forensic constraints, such as heterogeneous data sources, incomplete fragments, and class imbalance, while strictly preventing both feature-level and data-level leakage.

Dataset Selection and Preparation

To ensure relevance to practical forensic scenarios, two benchmark datasets are utilized: (1) the Digital Corpora dataset [27], which provides disk images with naturally occurring fragmentation, and (2) the AFF4 forensic container dataset [28], which models distributed and stream-based fragment storage.

Fragments are extracted from each disk image or container using file-carving and partial-byte-recovery techniques. Each training instance consists of:

• A content fragment of length n bytes, potentially truncated, corrupted, or partially overwritten.
• Metadata attributes, including access and modification timestamps, file size, and permission indicators.
• A ground truth label corresponding to the fragment class (e.g., file type or reconstruction category).

To preserve experimental validity, the target label is used exclusively for supervision and is not included in the input representation. All features are derived from intrinsic properties of the data rather than explicit identifiers.

Dataset partitioning is performed using a group-aware strategy based on source identifiers (e.g., file or disk image). All fragments originating from the same source are assigned to a single subset (training, validation, or test), ensuring that no logically related samples or shared metadata context appear across splits.

Fragmentation conditions simulated during training include:

• Random byte removal to emulate deletion or overwrite;
• Byte-shifted fragments to represent format-preserving corruption;
• Out-of-order fragments across distributed AFF4 streams.

This setup enables evaluation under realistic, challenging forensic conditions while maintaining a strict separation between training and evaluation data.

3.5. Role of PatternMiner Within the Forensic Workflow

PatternMiner is designed as a fragment-level forensic pattern-recognition framework rather than a complete file-reconstruction or carving system. The proposed architecture does not directly reconstruct full files, recover exact fragment ordering, or replace traditional file-carving algorithms. Instead, it operates as an intelligent analysis layer that assists forensic workflows by classifying, prioritizing, and contextualizing fragmented evidence.

More specifically, PatternMiner operates after low-level fragment extraction has already been performed by conventional forensic acquisition or carving tools. The framework accepts partially recovered fragments together with associated metadata and produces probabilistic fragment classifications and structural pattern representations.

Accordingly, the proposed framework should be interpreted as complementary to existing forensic reconstruction pipelines rather than a replacement for them. Traditional carving systems, such as header–footer carving, signature-based recovery, Bifragment Gap Carving, and SmartCarving, remain responsible for:

• Low-level fragment extraction;
• Fragment boundary identification;
• Block adjacency estimation;
• Exact file reassembly.

PatternMiner instead contributes higher-level semantic and structural inference capabilities that may support these reconstruction systems in several ways:

• Fragment-type prioritization;
• Corrupted-fragment classification;
• Confidence-guided carving;
• Reconstruction candidate ranking;
• Contextual forensic triage.

For example, in a practical forensic workflow, traditional carving algorithms may first recover disordered fragments from disk sectors or forensic containers. PatternMiner can then analyze these fragments to estimate probable file categories or structural relationships, thereby reducing the search space for downstream reconstruction algorithms such as Bifragment Gap Carving or SmartCarving.

Importantly, the current framework does not explicitly model fragment adjacency graphs, gap estimation, or ordering optimization. Consequently, it should not be interpreted as a direct replacement for graph-based or optimization-based file reassembly systems.

Figure 4 illustrates the conceptual integration of PatternMiner within a broader digital forensic reconstruction pipeline.

Figure 4. Conceptual integration of PatternMiner within a digital forensic reconstruction workflow.

3.5.1. Preprocessing

Each input instance undergoes a multi-stage preprocessing pipeline to ensure consistency across modalities and to construct a semantically meaningful representation without introducing label-derived information.

• Metadata Normalization

Numerical metadata features, such as timestamps and file size, are normalized to the range $[0,1]$ using min-max scaling:

$$x_i^{\mathrm{norm}}={\displaystyle \frac{x_i-min\left(x\right)}{max\left(x\right)-min\left(x\right)}}$$

(10)

This normalization improves numerical stability and accelerates convergence during training. Timestamps are first converted to a consistent representation (e.g., UNIX epoch) before scaling.

2.

Categorical Encoding

Categorical metadata is restricted to non-label attributes, specifically permission indicators. These are encoded as binary vectors:

$$\mathbf{p}=[1,0,1]$$

(11)

Only intrinsic attributes are included; no label-derived information is used in feature construction.

3.

Byte-Level Embedding

Each content fragment F is represented as a sequence of raw bytes:

$$F=[b_1,b_2,\dots ,b_n],b_i\in \{0,1,\dots ,255\}$$

Fragments are standardized to a fixed length (e.g., $n=512$ bytes) via truncation or zero-padding. Each byte is then mapped into a d-dimensional embedding space:

$$\mathrm{Embed}:0,\dots ,255\to {\mathbb{R}}^d$$

(12)

The resulting representation is:

$$\mathbf{c}=[{\mathbf{e}}_1,{\mathbf{e}}_2,\dots ,{\mathbf{e}}_n]\in {\mathbb{R}}^{n\times d}$$

(13)

This embedding captures both local structural patterns and distributional characteristics of fragmented content.

4.

Input Construction

The final input vector is formed by concatenating metadata and flattened content embeddings:

$$\mathbf{x}=[\mathbf{m}\Vert \mathrm{Flatten}(\mathbf{c}\left)\right]$$

(14)

where $\mathbf{m}\in {\mathbb{R}}^{d_m}$ and $\mathrm{Flatten}\left(\mathbf{c}\right)\in {\mathbb{R}}^{n·d}$. This unified representation enables joint learning from contextual and structural signals.

3.5.2. Training Configuration

The dataset is partitioned into training (70%), validation (15%), and testing (15%) subsets using group-aware splitting. Within each subset, class distributions are approximately preserved to maintain representativeness.

To improve generalization and mitigate overfitting, the following regularization techniques are applied:

• Dropout: Applied to fully connected layers with a probability of $p=0.3$.
• Batch Normalization: Applied after convolutional and dense layers to stabilize training and accelerate convergence.

Optimizer

Model parameters are optimized using the Adam optimizer:

$${\theta }_{t+1}={\theta }_t-\alpha ·{\displaystyle \frac{{\widehat{m}}_t}{\sqrt{{\widehat{v}}_t}+ϵ}}$$

(15)

where $\alpha =1\times {10}^{-4}$ is the learning rate.

Training Schedule

Training is conducted for up to 50 epochs. Early stopping is applied if the validation loss does not improve for seven consecutive epochs, ensuring that model selection is based on generalization performance.

3.5.3. Loss Function

The task is formulated as a multi-class classification problem. The categorical cross-entropy loss is used:

$$\mathcal{L}=-{\displaystyle \sum _{i=1}^N}{y}_{i}log\left({\widehat{y}}_i\right)$$

(16)

where $y_i$ is the true label and ${\widehat{y}}_i$ is the predicted probability for class i.

Since the input representation excludes any label-derived attributes, the loss function evaluates the model’s ability to learn meaningful patterns from intrinsic content and metadata features.

3.6. Implementation Details and Reproducibility

To improve experimental reproducibility and facilitate future comparative evaluations, this section summarizes the architectural configuration, optimization settings, and data partitioning protocol used in the proposed framework.

3.6.1. CNN Configuration

The convolutional component consists of three one-dimensional convolutional layers applied to the embedded byte-level fragment representation. The configuration is summarized as follows:

• Convolutional layers: 3;
• Filter sizes: {64, 128, 256};
• Kernel sizes: {3, 5, 7};
• Activation function: ReLU;
• Padding strategy: same padding;
• Pooling: max pooling after each convolutional block;
• Batch normalization: applied after each convolutional layer;
• Dropout rate: 0.3.

3.6.2. LSTM Configuration

The sequential modeling component uses a stacked LSTM architecture operating on the fused latent representations.

• Number of LSTM layers: 2;
• Hidden dimension: 128;
• Bidirectionality: disabled;
• Dropout between layers: 0.3.

3.6.3. Transformer Configuration

The Transformer encoder is responsible for modeling long-range dependencies across fragmented representations.

• Number of Transformer encoder layers: 2;
• Attention heads: 8;
• Embedding dimension: 128;
• Feed-forward hidden dimension: 512;
• Positional encoding: sinusoidal positional encoding;
• Attention dropout: 0.1.

3.6.4. Training Configuration

The complete training configuration is summarized below:

• Optimizer: Adam;
• Initial learning rate: $1\times {10}^{-4}$;
• Batch size: 64;
• Maximum epochs: 50;
• Early stopping patience: 7 epochs;
• Weight initialization: Xavier initialization;
• Loss function: categorical cross-entropy.

The proposed framework was implemented using PyTorch and trained on NVIDIA RTX-series GPUs. Random seeds were fixed across all experiments to improve reproducibility.

3.6.5. Data Partitioning and Split Reproducibility

Dataset partitioning was performed using deterministic group-aware splitting based on disk-image or container-level source identifiers. All fragments originating from the same source group were restricted to a single partition.

The resulting split configuration consisted of:

• 70% training groups;
• 15% validation groups;
• 15% testing groups.

To preserve anonymity during peer review, explicit dataset indices and source identifiers are omitted from the submitted manuscript. However, the complete preprocessing pipeline, split-generation procedure, and training configuration will be released upon publication to facilitate reproducibility and independent verification.

Table 4 provides a summary of key hyperparameters used in PatternMiner.

Table 4. Summary of key hyperparameters used in PatternMiner.

Hyperparameter	Value
Fragment length	512 bytes
Embedding dimension	128
CNN layers	3
CNN filters	{64, 128, 256}
CNN kernel sizes	{3, 5, 7}
LSTM layers	2
LSTM hidden dimension	128
Transformer layers	2
Transformer heads	8
Feed-forward dimension	512
Dropout rate	0.3
Batch size	64
Learning rate	$1\times {10}^{-4}$
Maximum epochs	50
Optimizer	Adam
Early stopping patience	7

3.7. Leakage Prevention Strategy

To ensure the validity and reliability of the evaluation, explicit safeguards are implemented to prevent both direct and indirect label leakage.

• Feature-Level Isolation

Input features are constructed exclusively from intrinsic attributes. Any feature that directly encodes the prediction target is excluded. In particular, file type information is not included in the metadata or feature representation.

• Strict Input–Label Separation

The target variable is used solely for supervision during training and evaluation during testing. At no stage is label information incorporated into the input space.

• Group-Aware Data Partitioning

Dataset splitting is performed at the source level (file or disk image). All fragments from the same source are assigned to a single subset, preventing cross-set contamination and ensuring evaluation on truly unseen data.

• Implications for Model Validity

These safeguards ensure that the model learns from intrinsic structural and contextual patterns rather than exploiting dataset-specific shortcuts. Consequently, the reported performance reflects genuine generalization to unseen forensic data.

Overall, this leakage prevention strategy aligns the experimental protocol with best practices in machine learning and strengthens the scientific validity of the proposed framework.

3.8. Group Hierarchy and Content-Overlap Control

To ensure a rigorous separation between training and evaluation data, the dataset was partitioned using a hierarchical, group-aware strategy. In this work, the term “group” refers to the highest available forensic source unit from which fragments are derived.

Specifically:

• For the Digital Corpora dataset, grouping was performed at the disk-image level.
• For AFF4 forensic containers, grouping was performed at the container level.

Consequently, all fragments originating from the same disk image or AFF4 container were assigned exclusively to a single subset (training, validation, or testing). This design prevents source-level contamination and avoids including logically related fragments across different splits.

In addition to source-level grouping, overlap-aware fragment extraction was employed to reduce leakage of near-duplicate content caused by sliding-window extraction. Fragments were extracted using a sliding-window strategy with controlled overlap. Specifically, 512-byte fragments were generated with a 256-byte stride, resulting in 50% overlap between adjacent fragments. This overlap-aware sampling strategy was intentionally adopted to improve coverage of boundary-level fragmentation artifacts and preserve partially distributed structural signatures across neighboring windows. Nevertheless, fragmented forensic datasets inherently contain structurally similar content due to shared file formats, repeated headers, compression signatures, and common encoding structures. Therefore, complete elimination of semantic similarity between fragments is not always possible, even under strict group-aware partitioning.

The overlap-aware extraction strategy reduces the likelihood of losing critical byte-level signatures near fragment boundaries and improves robustness to truncation and partial corruption.

To evaluate the impact of potential content overlap on generalization, we also measured model performance under overlap-restricted partitioning. In this experiment, fragments exhibiting high byte-level similarity with training samples were excluded from the evaluation subset using hash-based similarity filtering.

Table 5 summarizes the resulting performance.

Table 5. Impact of overlap-aware partitioning on generalization performance.

Partitioning Strategy	Accuracy (%)	Macro F1 (%)
Standard group-aware split	92.1	91.8
Overlap-restricted split	89.4	88.9

The moderate reduction in performance under overlap-restricted evaluation suggests that certain shared structural patterns contribute to classification performance; however, the proposed framework maintains strong generalization capability even after aggressive overlap filtering. These findings support the robustness of the proposed architecture beyond simple memorization of repeated fragment structures.

3.9. Leakage Elimination and Verification Procedure

Ensuring the absence of label leakage is critical in forensic machine learning, particularly in fragment classification tasks where metadata may implicitly encode the prediction target. In many forensic datasets, attributes such as filenames, file extensions, MIME descriptors, directory paths, or application-specific identifiers can directly reveal the underlying class, enabling models to achieve artificially inflated performance without learning meaningful forensic patterns. To ensure that the proposed framework learns only from intrinsic structural and contextual characteristics, we implemented a multi-stage leakage elimination and verification procedure.

3.9.1. Metadata Sanitization

Prior to feature construction, all metadata attributes were systematically inspected and filtered to remove any information that could directly or indirectly encode the target label. Specifically, the following attributes were excluded from the dataset:

• Filenames and partial filename strings;
• File extensions (e.g., .jpg, .pdf, .exe);
• MIME types and content descriptors;
• Directory and filesystem paths;
• Application-specific identifiers;
• Container object names and semantic labels;
• Any categorical field explicitly describing file type or content category.

Only intrinsic, non-semantic metadata attributes were retained, including:

• Access timestamps;
• Modification timestamps;
• File size;
• Permission indicators (read, write, execute).

These retained attributes provide contextual forensic information while avoiding explicit disclosure of the prediction target.

3.9.2. Automated Leakage Auditing

To further ensure the integrity of the preprocessing pipeline, automated schema-level audits were performed prior to model training. Each metadata attribute was programmatically analyzed to detect deterministic or near-deterministic relationships with the ground-truth labels.

In particular, all categorical metadata fields were inspected for direct string overlap with class identifiers, semantic descriptors, or extension patterns. Attributes exhibiting trivial correspondence with target classes were automatically excluded before feature encoding.

In addition, statistical dependency analysis was conducted to assess the relationships between metadata attributes and class labels using mutual information and frequency-based association measures. This analysis verified that no retained feature exhibited a deterministic mapping to the prediction target.

3.9.3. Mutual-Information-Based Leakage Audit

In addition to removing explicitly label-derived attributes, we examined whether the retained metadata features exhibit strong statistical dependence on the target labels. This step is important because features such as file size, timestamps, and permission indicators may indirectly correlate with file type distributions in forensic datasets.

To quantify this risk, we computed the Mutual Information (MI) between each retained metadata feature and the ground-truth class label. Let $X_j$ denote a metadata feature and Y denote the class label. The mutual information is defined as:

$$I(X_j;Y)=\sum _{x\in X_j}\sum _{y\in Y}p(x,y)log{\displaystyle \frac{p(x,y)}{p\left(x\right)p\left(y\right)}}.$$

(17)

Higher MI values indicate stronger dependence between a feature and the target label. Features with unusually high MI may therefore represent indirect leakage or dataset-specific class shortcuts. In this work, the MI audit was used as a diagnostic procedure rather than as the sole criterion for feature exclusion.

Table 6 reports the mutual information scores for the retained metadata features.

Table 6. Mutual-information-based leakage audit for retained metadata features.

Metadata Feature	Mutual Information with Class Label
File size	0.184
Last access timestamp	0.071
Last modification timestamp	0.083
Read permission	0.026
Write permission	0.031
Execute permission	0.044

The results show that file size has the strongest dependence on the target label, whereas timestamp and permission attributes exhibit comparatively weaker associations. Although none of the retained metadata features directly encodes the class label, this analysis confirms that residual class correlations may exist in intrinsic metadata. Therefore, the term “explicit-leakage-controlled” in this work refers specifically to the exclusion of explicit label-derived attributes and prevention of cross-source contamination, rather than the complete absence of all statistical dependence between metadata and labels.

Although the proposed preprocessing pipeline removes explicit label-derived attributes such as file extensions, MIME types, filenames, and path descriptors, retained intrinsic metadata may still contain residual statistical correlations with the target labels. The mutual-information audit showed that file size has a moderate association with class labels, whereas timestamp and permission features exhibit weaker associations. Therefore, the revised manuscript narrows the explicit-leakage-controlled claim: the proposed protocol is free from explicit label leakage and source-level contamination, but not necessarily from all indirect dataset correlations. This limitation is now acknowledged, and future work will investigate feature regularization, adversarial debiasing, and MI-threshold-based feature filtering to further reduce metadata-driven shortcuts.

3.9.4. Group-Aware Partitioning

Indirect leakage may also arise when logically related fragments appear across multiple dataset partitions. To prevent this issue, the dataset was split using a strict, group-aware strategy based on source-level identifiers.

All fragments originating from the same source file, disk image, or AFF4 container object were assigned exclusively to a single partition (training, validation, or testing). Formally, let:

$$G=\{G_1,G_2,\dots ,G_K\}$$

(18)

denote the set of source-level groups, where:

• G represents the complete set of source-level groups;
• $G_k$ denotes the k-th group corresponding to a single source origin;
• K is the total number of source-level groups in the dataset.

Each group contains all fragments derived from the same source file, disk image, or AFF4 container object. The partitioning process ensures:

$$G_i\cap G_j=\varnothing \forall i\ne j$$

(19)

where:

• $G_i$ and $G_j$ denote any two distinct dataset groups;
• ∩ represents the set intersection operator;
• ∅ denotes the empty set;
• $\forall i\ne j$ indicates that the condition holds for all distinct group pairs.

This guarantees that no source-level group appears across multiple dataset partitions.

3.9.5. Leakage Verification Experiments

To empirically verify the absence of residual leakage, additional baseline experiments were conducted using metadata-only inputs. In these experiments, shallow classifiers, including Logistic Regression and Random Forest models, were trained exclusively on the retained metadata attributes without access to byte-level fragment content. The resulting performance remained substantially lower than that of the proposed multimodal framework, indicating that the retained metadata did not contain sufficient information to trivially infer class labels. This observation suggests that the proposed model learns meaningful structural and contextual representations rather than exploiting explicit identifiers or dataset-specific shortcuts.

Furthermore, randomization tests were performed by shuffling class labels while preserving the distribution of metadata. Under these conditions, model performance collapsed to near chance-level accuracy, providing additional evidence that the observed results are not driven by hidden leakage artifacts. The combination of metadata sanitization, automated auditing, group-aware partitioning, and empirical verification establishes a rigorous protocol for preventing leakage in forensic fragment analysis. These safeguards ensure that the reported performance reflects genuine learning of intrinsic forensic patterns rather than exploitation of explicit or implicit label-derived cues.

Consequently, the evaluation protocol provides a more reliable estimate of real-world generalization performance under practical forensic conditions involving fragmented, incomplete, and heterogeneous digital evidence.

Indirect Leakage Sensitivity Analysis

Although explicit label-derived metadata attributes were removed during preprocessing, certain intrinsic metadata features may still exhibit statistical correlations with the target classes. In particular, attributes such as file size or permission indicators may partially correlate with file type distributions in real-world forensic datasets. While such correlations do not constitute direct label leakage, they may nevertheless provide indirect predictive signals that artificially inflate classification performance if not properly analyzed.

To evaluate the extent of this potential indirect leakage, we conducted an additional leakage-sensitivity experiment using metadata-only classifiers. The objective of this experiment was not to construct a competitive forensic classifier, but rather to quantify the discriminative information contained solely within the retained metadata attributes.

Specifically, three lightweight baseline models were trained using only:

• Normalized file size;
• Permission indicators;
• Its combined representation.

No byte-level fragment content was included in this analysis. The same group-aware partitioning protocol described in Section 3.7 was preserved to prevent cross-source contamination between training and evaluation sets.

The evaluated classifiers included Logistic Regression and Random Forest models due to their simplicity and interpretability. Performance was measured using classification accuracy and macro-averaged F1-score.

Table 7 summarizes the results of the metadata-only leakage analysis.

Table 7. Indirect leakage sensitivity analysis using metadata-only features.

Input Features	Accuracy (%)	Macro F1 (%)
File size only	47.6	45.9
Permissions only	24.8	22.7
File size + permissions	54.3	52.1
PatternMiner (full model)	92.1	91.8

The results indicate that metadata-only models achieve performance substantially lower than the proposed PatternMiner framework. This suggests that the strong performance of the proposed architecture cannot be explained solely by simple metadata correlations; instead, it primarily arises from the joint modeling of byte-level structural patterns and contextual forensic information.

Nevertheless, the experiment also demonstrates that certain metadata attributes retain partial class-discriminative characteristics. Consequently, indirect leakage remains an important consideration in forensic machine learning and should be explicitly evaluated when designing fragment classification systems. Future work may further investigate metadata regularization and adversarial debiasing techniques to minimize residual class correlations in heterogeneous forensic datasets.

3.9.6. Evaluation Metrics

To rigorously evaluate PatternMiner’s performance on fragmented digital evidence, we adopt a set of well-established classification metrics that are particularly relevant to the forensic domain. These metrics assess overall predictive accuracy and evaluate the model’s ability to handle class imbalance, avoid spurious associations, maintain reliability under partial or corrupted inputs, and ensure computational efficiency in real-world deployments.

• Accuracy

Accuracy provides a general measure of how often the model correctly classifies a fragment’s forensic label (e.g., file type or origin):

$$\mathrm{Accuracy}={\displaystyle \frac{\mathrm{Number}\mathrm{of}\mathrm{Correct}\mathrm{Predictions}}{\mathrm{Total}\mathrm{Number}\mathrm{of}\mathrm{Predictions}}}={\displaystyle \frac{{\sum }_{i=1}^N⊮({\widehat{y}}_i=y_i)}{N}}$$

(20)

where:

• N is the total number of samples;
• ${\widehat{y}}_i$ is the predicted label for sample i;
• $y_i$ is the ground truth label;
• $⊮(·)$ is the indicator function (1 if true, 0 otherwise).

While useful, accuracy can be misleading if classes are imbalanced, as is often the case in forensic data, where certain file types dominate (e.g., many logs versus few executables).

2.

Precision

Precision evaluates how many of the fragments predicted as belonging to a given class do belong to it. High precision means few false positives:

$$\mathrm{Precision}={\displaystyle \frac{\mathrm{True}\mathrm{Positives}\left(\mathrm{TP}\right)}{\mathrm{True}\mathrm{Positives}\left(\mathrm{TP}\right)+\mathrm{False}\mathrm{Positives}\left(\mathrm{FP}\right)}}$$

(21)

This is critical in forensic settings where incorrectly associating unrelated fragments could lead to misleading narratives or false implications.

3.

Recall

Recall measures the model’s ability to identify all relevant fragments for a given class. High recall indicates few false negatives:

$$\mathrm{Recall}={\displaystyle \frac{\mathrm{True}\mathrm{Positives}\left(\mathrm{TP}\right)}{\mathrm{True}\mathrm{Positives}\left(\mathrm{TP}\right)+\mathrm{False}\mathrm{Negatives}\left(\mathrm{FN}\right)}}$$

(22)

For example, if the system fails to recover or correctly label suspicious email fragments, the investigation’s comprehensiveness will be compromised.

4.

F1-Score

The F1-score is the harmonic mean of precision and recall, providing a balanced view of model performance. It is advantageous in imbalanced datasets where high precision or recall alone may not suffice:

$$\mathrm{F}1-\mathrm{score}={\displaystyle \frac{2·\mathrm{Precision}·\mathrm{Recall}}{\mathrm{Precision}+\mathrm{Recall}}}$$

(23)

5.

Macro and Weighted Averages

Since the classification task may involve multiple fragment classes (e.g., different file types or source clusters), we report both:

• Macro-Averaged F1: Averaged equally over all classes, highlighting per-class performance.
• Weighted-Averaged F1: Accounts for class imbalance by weighting each class’s F1-score by its support (sample count).

Because the forensic fragment dataset exhibits moderate class imbalance, accuracy alone is insufficient for reliable performance assessment. Accordingly, Macro-F1, macro-averaged precision, and macro-averaged recall are emphasized throughout the evaluation to ensure balanced assessment across both majority and minority forensic categories.

6.

Robustness Evaluation

In addition to standard classification performance, we assess robustness under degraded conditions:

• Ablation accuracy: Performance when only content or only metadata is available.
• Noise resilience: Accuracy under increasing fragment corruption or byte substitution.

These robustness metrics simulate real-world forensic limitations, such as damaged disk sectors or partial metadata loss, and demonstrate PatternMiner’s practical viability.

7.

Computational Efficiency

To evaluate the feasibility of deploying PatternMiner in time-sensitive forensic workflows, we report:

• Inference Time: The average time to process a single input fragment (content + metadata). This reflects the model’s responsiveness during live or batch investigations.
• FLOPS (Floating Point Operations per Second): An estimate of the model’s computational complexity, helpful in comparing the efficiency of different architectural configurations (e.g., CNN vs. CNN + LSTM + Transformer).

These metrics provide critical insights into resource requirements and scalability, particularly for field deployment on constrained hardware (e.g., forensic workstations, portable kits).

This evaluation is crucial in real-world cases where fragment sizes vary due to deletion, corruption, or storage policies.

3.9.7. Illustrative Forensic Scenario

To clarify the practical applicability of the proposed framework, we present a representative forensic scenario involving fragmented and incomplete digital evidence.

Consider a case in which a document file (e.g., PDF or DOCX) has been partially deleted or overwritten. As a result, only a set of disjoint byte fragments remains on disk, along with incomplete metadata such as timestamps and file permissions. Due to missing segments and structural corruption, traditional forensic tools often fail to reconstruct the original file or reliably determine its type.

As illustrated in Figure 5, PatternMiner operates directly on the available fragments without requiring full file reconstruction. Each fragment is first encoded as a sequence of byte embeddings, while associated metadata (e.g., access time, modification time, and file size) is normalized and represented as a feature vector. These inputs are then processed through the hybrid architecture.

Figure 5. Illustrative forensic workflow: an original file undergoes fragmentation and corruption, resulting in disjoint byte fragments and partial metadata. PatternMiner analyzes these inputs to infer the most probable file type without requiring full reconstruction.

For instance, a fragment may contain partial byte patterns corresponding to compressed structures or document-specific encodings (e.g., ZIP-based signatures in DOCX files). The CNN component captures such local structural cues, even when incomplete. In parallel, metadata provides contextual signals (e.g., typical file sizes or recent modification activity), which are modeled by the LSTM component. The Transformer further captures global relationships across fragmented inputs.

By integrating these complementary signals, the model infers the most probable class (e.g., document, image, executable) or origin of each fragment, even when critical portions of the file are missing.

Importantly, PatternMiner is not designed to reconstruct the original file, but rather to support forensic analysis by identifying meaningful patterns within incomplete evidence. In practical terms, this enables investigators to:

• Identify the likely type or category of fragmented artifacts;
• Detect suspicious or anomalous fragments;
• Prioritize relevant evidence for further investigation.

This example demonstrates how PatternMiner provides actionable insights in scenarios where reconstruction-based approaches are ineffective, thereby enhancing the interpretability and usability of fragmented digital evidence in real-world forensic workflows.

4. Dataset and Implementation

To evaluate PatternMiner under realistic forensic conditions, we utilize two complementary datasets that capture both naturally occurring and synthetically generated fragmentation patterns. These datasets include raw content fragments, associated metadata, and diverse storage contexts such as disk images and forensic containers.

This section describes the dataset construction process, feature representation, grouping and partitioning strategy, and implementation details used for training and evaluation. The experimental design explicitly prevents both feature-level and data-level leakage, ensuring that performance reflects genuine pattern recognition capability.

4.1. Dataset Collection

Two complementary datasets are used to evaluate PatternMiner under both real-world and controlled forensic conditions.

• Digital Corpora Dataset [27]:

  -

  Contains realistic disk images derived from forensic training scenarios, including the “EVIDENCE_OF” series (e.g., EVIDENCE_OF_IM, EVIDENCE_OF_TOR).

  -

  Source files span multiple categories (e.g., documents, images, executables, logs), reflecting real-world forensic diversity.

  -

  Fragmentation arises naturally due to deletion, reallocation, overwriting, and file system behavior.

  -

  Fragments are extracted using standard file-carving and byte-level segmentation techniques (Section 4.6.1), preserving authentic artifact distributions.

  -

  The dataset exhibits moderate class imbalance, consistent with practical forensic environments.

• AFF4 Synthetic Dataset [28]:

  -

  A synthetically constructed dataset based on the AFF4 (Advanced Forensics File Format) framework, designed to simulate realistic fragmentation scenarios under controlled conditions.

  -

  Source files are drawn from diverse categories (e.g., documents, multimedia, executables) and segmented into fixed-length fragments (512 bytes) using a sliding-window approach.

  -

  Controlled fragmentation is introduced through stochastic transformations, including:

  ∗

  Random byte removal (typically 10–30% of fragment length);

  ∗

  Truncation at random offsets to simulate partial recovery;

  ∗

  Byte shifting to emulate misaligned storage blocks;

  ∗

  Out-of-order reassembly across AFF4 streams to replicate non-contiguous storage.

  -

  Metadata attributes (timestamps, file size, permissions) are derived from source files and normalized; no label-derived features are included.

  -

  Class distributions are constructed to be approximately balanced across categories to enable controlled evaluation.

  -

  All generation procedures are performed using a fixed random seed ($s=42$) to ensure deterministic behavior and reproducibility.

  -

  The dataset generation pipeline, including transformation parameters and configuration settings, will be made publicly available to facilitate replication.

Table 8 illustrates the class distribution of the forensic fragment dataset. Although the dataset exhibits moderate class imbalance across forensic categories, no individual class overwhelmingly dominates the distribution. The imbalance primarily reflects the natural variability of fragment availability across heterogeneous forensic artifacts and storage structures.

Table 8. Class distribution of the forensic fragment dataset.

File Category	Fragments	Percentage
Document Files	10,200	13.6%
Image Files	11,500	15.3%
Video Files	8700	11.6%
Audio Files	7900	10.5%
Executable Files	9600	12.8%
Compressed Archives	8100	10.8%
Database Files	9200	12.3%
Other Structured Files	9800	13.1%
Total	75,000	100%

To mitigate potential bias toward majority classes, multiple safeguards were incorporated during training and evaluation. First, dataset partitioning preserved approximate class proportions across the training, validation, and test subsets using stratified, group-aware splitting. Second, weighted categorical loss functions were employed during optimization to reduce dominance effects associated with higher-frequency classes. Third, evaluation emphasized macro-averaged performance metrics, including Macro-F1, Precision, and Recall, which assign equal importance to minority and majority categories.

Consequently, the reported performance metrics provide a more reliable estimate of balanced classification capability under heterogeneous forensic conditions rather than reflecting majority-class prediction bias alone.

The combination of real-world (Digital Corpora) and synthetic (AFF4) datasets enables comprehensive evaluation across both naturally occurring and controlled fragmentation conditions. While Digital Corpora reflects realistic artifact distributions and class imbalance, the AFF4 dataset provides a controlled environment for systematically assessing model robustness under varying fragmentation and corruption scenarios.

To improve transparency regarding dataset composition and source-level diversity, Table 9 summarizes the Digital Corpora subset used in the experimental evaluation. The dataset was constructed from multiple independent forensic disk images spanning diverse investigative scenarios, including instant messaging activity, anonymized browsing behavior, removable storage usage, and enterprise-style user environments. Approximately 45,000 fragments were extracted from these source images using the fragment generation pipeline. Each disk image was treated as a distinct source-level group during dataset partitioning to prevent cross-set contamination and ensure evaluation on previously unseen forensic sources.

Table 9. Digital Corpora subset statistics used in the experimental evaluation.

Scenario	Number of Disk Images	Number of Fragments
EVIDENCE_OF_IM	4	9200
EVIDENCE_OF_TOR	3	8500
EVIDENCE_OF_USB	3	7300
M57	5	12,400
Other Scenarios	2	7600
Total	17	45,000

4.2. Data Representation and Feature Construction

Each data sample consists of a fixed-length content fragment and associated metadata features. The representation is designed to capture intrinsic structural and contextual information while excluding any label-derived attributes.

• Content Fragment:

  -

  Each instance consists of a fixed-length fragment of 512 bytes.

  -

  Fragments are extracted using forensic carving and partial-byte-recovery techniques.

  Fragments are standardized to a fixed length of 512 bytes in our experiments. This value was selected based on both empirical evaluation and practical considerations. Specifically, we conducted experiments with fragment sizes of 256, 512, and 1024 bytes. Smaller fragments (256 bytes) were found to contain insufficient contextual and structural information, leading to reduced classification performance. Larger fragments (1024 bytes) provided only marginal performance gains while increasing computational cost and memory requirements.
  The 512-byte configuration provided an effective balance between representational richness and efficiency. Additionally, while modern storage devices often use larger sector sizes (e.g., 4096 bytes), fragmented data recovered from unallocated space is frequently non-contiguous and does not align with physical sector boundaries. As a result, models must operate on partial and arbitrarily sized fragments rather than full-sector inputs.
• Metadata Features:

  -

  Access and modification timestamps, normalized to the range $[0,1]$.

  -

  File size, scaled using min-max normalization.

  -

  File permissions, encoded as binary indicators (e.g., read, write, execute).

• Excluded Attributes:

  -

  File type is explicitly excluded from the input representation, as it constitutes the prediction target.

  -

  Any feature that directly encodes or strongly correlates with the ground truth label is not included.

• Ground Truth Labels:

  -

  Each fragment is assigned a label corresponding to its class (e.g., file type or reconstruction category).

  -

  Labels are used exclusively for supervision during training and evaluation.

4.3. Fragment Extraction and Grouping

Fragments are extracted at the file level, with each fragment retaining a reference to its source (file or disk image).

Grouping Strategy:

• All fragments originating from the same source are treated as a single group.
• This grouping is preserved throughout dataset construction and partitioning.

This design ensures that logically related fragments are not treated as independent samples, preventing artificial inflation of performance due to shared structure or metadata context.

4.4. Dataset Partitioning

To ensure a valid and unbiased evaluation, the dataset is partitioned using a group-aware splitting strategy that prevents leakage across training, validation, and test sets.

• Each fragment is associated with a source-level identifier corresponding to its origin (i.e., a file in Digital Corpora or a stream/container object in AFF4).
• All fragments derived from the same source are assigned exclusively to a single subset (training, validation, or testing).
• No fragments from the same source appear across multiple subsets.
• This prevents near-duplicate samples and shared contextual information from introducing data leakage.

The dataset is partitioned into:

• 70% training set;
• 15% validation set;
• 15% test set.

Explicit Split Construction Procedure

To ensure reproducibility, dataset partitioning is performed using a deterministic group-level procedure. Let $\mathcal{G}=G_1,G_2,\dots ,G_K$ denote the set of source-level groups, where each group $G_k$ contains all fragments originating from a single file or container object.

The groups are first randomly shuffled using a fixed random seed ($s=42$) and then partitioned into training, validation, and test subsets according to the specified ratios. Splitting is performed at the group level such that:

• $G_k\cap G_l=\varnothing$ across subsets;
• Each group is assigned to exactly one subset;
• All fragments within a group remain in the same subset.

This procedure is applied independently to each dataset (Digital Corpora and AFF4) prior to combining splits. Class distributions are approximately preserved across subsets to maintain representativeness.

This explicit partitioning strategy ensures that evaluation is conducted on truly unseen source-level data, eliminating leakage arising from shared structure, metadata context, or fragment similarity.

4.5. Realistic Fragmentation Validation

While synthetic fragmentation provides controlled degradation scenarios, real file system fragmentation is not purely random. In practice, fragment placement is influenced by allocation policies, file creation and deletion histories, storage utilization, operating system behavior, and user activity patterns. Therefore, relying exclusively on fixed-seed random fragmentation may overestimate robustness under operational forensic conditions.

To address this concern, we added a realistic-fragmentation validation setting using disk-image-derived fragments from Digital Corpora. Unlike the fixed-seed AFF4 fragmentation process, these fragments were extracted from real disk images, where fragmentation patterns arise from naturally occurring file system allocation and usage behavior. The evaluation was performed using the same group-aware partitioning protocol to ensure that all fragments from the same disk image remained within a single split.

In addition, we evaluated a file-system-aware fragmentation setting in which fragment generation followed allocation-inspired constraints rather than purely random byte removal. Specifically, fragment boundaries were aligned to fixed block sizes, contiguous block runs were preserved when possible, and discontinuities were introduced to emulate file allocation gaps caused by deletion and reallocation. This setting provides a more realistic intermediate scenario between fully synthetic random fragmentation and naturally fragmented disk images.

Table 10 reports the performance of PatternMiner under different fragmentation settings.

Table 10. Performance under different fragmentation-generation settings.

Fragmentation Setting	Accuracy (%)	Macro F1 (%)
Fixed-seed random AFF4 fragmentation	92.1	91.8
File-system-aware simulated fragmentation	90.3	89.7
Naturally fragmented disk-image validation	88.9	88.2

The results show a moderate performance reduction when moving from fixed-seed random fragmentation to file-system-aware and naturally fragmented disk-image settings. This indicates that random fragmentation provides a useful controlled benchmark, but does not fully capture the complexity of real file system behavior. Nevertheless, PatternMiner maintains robust performance under more realistic fragmentation conditions, supporting its generalization beyond purely synthetic degradation.

4.6. Implementation Details

The PatternMiner framework is implemented as a hybrid deep learning pipeline that integrates byte-level embeddings, metadata encoding, and multimodal feature learning.

• Input Representation:

  -

  Content fragments are embedded into a continuous vector space.

  -

  Metadata features are normalized and concatenated with content embeddings.

  -

  No label-derived features are included in the input representation.

• Model Architecture:

  -

  Hybrid architecture combining CNN, LSTM, and Transformer components.

  -

  Designed to capture local, sequential, and global dependencies across fragmented inputs.

• Training Setup:

  -

  Optimized using the Adam optimizer with a learning rate of $1\times {10}^{-4}$.

  -

  Early stopping is applied based on validation loss to prevent overfitting.

  -

  Regularization techniques include dropout and batch normalization.

• Evaluation Protocol:

  -

  Performance is evaluated on a held-out test set with no shared source-level overlap.

  -

  Metrics include accuracy, precision, recall, and F1-score.

  -

  Additional robustness evaluation is conducted under varying levels of fragment corruption and metadata degradation.

This implementation ensures that the reported performance reflects the model’s ability to generalize to unseen forensic data, rather than exploiting trivial correlations or dataset-specific artifacts.

4.6.1. Fragment Generation and Simulation Pipeline

To ensure reproducibility and accurately reflect real-world forensic conditions, we define a structured pipeline for fragment extraction and simulation. This process is applied consistently to both the Digital Corpora dataset and the synthetic AFF4 dataset, while maintaining a strict separation between input features and ground-truth labels.

Fragment Extraction

Source files are identified from disk images (Digital Corpora) or container streams (AFF4). Each file is segmented into fixed-length 512-byte fragments using a sliding window approach. Files shorter than 512 bytes are zero-padded, while longer files are divided into multiple fragments, either overlapping or non-overlapping, depending on the underlying storage layout.

Each fragment retains a reference to its originating source (file or disk image), which is subsequently used for group-aware dataset partitioning to prevent cross-set contamination.

Fragmentation Simulation

To emulate realistic forensic conditions, multiple degradation strategies are applied:

• Random byte removal: A proportion of bytes (typically 10–30%) is removed to simulate deletion or overwrite events.
• Truncation: Fragments are truncated at random offsets to represent incomplete recovery from damaged storage sectors.
• Byte shifting: Fragments are misaligned to simulate block-level corruption or offset inconsistencies.
• Out-of-order arrangement: In AFF4-based data, fragments belonging to the same source are randomly reordered to replicate non-contiguous storage across distributed streams.

These transformations introduce controlled variability while preserving intrinsic structural characteristics necessary for forensic pattern learning.

Metadata Association

Each fragment is paired with metadata extracted from its source, including:

• Access and modification timestamps;
• File size;
• Permission attributes.

File type information is explicitly excluded from metadata, as it constitutes the prediction target. This ensures that no label-derived information is introduced into the input features.

All metadata fields are normalized and encoded as described in Section 5.3.1.

Dataset Construction and Fragment Generation Procedure

To improve reproducibility, the dataset construction process follows a deterministic, multi-stage pipeline comprising source selection, fragment extraction, corruption simulation, filtering, and group-aware partitioning.

Source-Level Partitioning: Each source file, disk image, or AFF4 container object was assigned a unique source identifier prior to fragment extraction. Group-aware dataset partitioning was subsequently performed at the source level such that all fragments originating from the same source remained within a single dataset subset (training, validation, or testing). This procedure prevents cross-set contamination arising from structurally related fragments or shared metadata context.

Fragment Extraction Strategy: Files were segmented into fixed-length 512-byte fragments using a sliding-window extraction procedure. For Digital Corpora disk images, fragments were generated using a stride size of 256 bytes, corresponding to a 50% overlap between adjacent fragments. This overlap strategy was adopted to increase structural diversity while preserving continuity across fragmented regions.

Files shorter than 512 bytes were zero-padded to the required length, while larger files produced multiple overlapping fragments. Fragment extraction was applied consistently across all source datasets.

Corruption and Fragmentation Simulation: To emulate realistic forensic degradation conditions, the extracted fragments were subjected to controlled corruption operations, including:

• Random byte removal affecting 10–30% of fragment bytes;
• Random truncation at variable offsets;
• Byte shifting to simulate block misalignment;
• Out-of-order fragment rearrangement for AFF4 stream simulation.

All stochastic operations were performed using a fixed random seed ($s=42$) to ensure deterministic reproducibility.

Filtering Criteria: Fragments were discarded under the following conditions:

• More than 70% of bytes were removed or corrupted;
• The fragment contained insufficient non-zero content after preprocessing;
• Associated metadata fields were incomplete or invalid;
• Duplicate fragments generated from repeated extraction windows were detected.

After filtering, the final dataset comprised approximately 75,000 valid fragments distributed across the Digital Corpora and AFF4 datasets.

Label Assignment

Ground truth labels are assigned based on the original file type or logical source from which the fragment was extracted. These labels are used exclusively for supervision during training and evaluation and are never included in the input representation.

Determinism and Reproducibility

All fragment-generation steps are performed with a fixed random seed to ensure deterministic behavior. This guarantees that identical input datasets produce the same fragmented samples across runs, facilitating reproducibility and independent verification.

This pipeline provides a controlled yet realistic approximation of fragmented digital evidence encountered in forensic investigations, enabling reliable, unbiased evaluation under varying degrees of data degradation.

4.6.2. Dataset Statistics

To enhance transparency and reproducibility, we provide a detailed summary of the datasets used in our experiments, including dataset cardinality, class composition, and distribution characteristics. The dataset is constructed from two primary sources: the Digital Corpora dataset (real-world disk images) and a synthetic dataset generated using AFF4 forensic containers.

After applying the fragment generation pipeline (Section 4.6.1), the final dataset comprises approximately 75,000 fragments spanning multiple forensic classes, with varying degrees of fragmentation and corruption.

Table 11 summarizes the dataset statistics.

Table 11. Dataset statistics after fragment generation.

Dataset	Fragments	Classes	Avg. Size	Fragmentation Types	Class Balance
Digital Corpora	45,000	Document, media, and executable classes (e.g., PDF, DOCX, JPG, EXE)	512 bytes	Deletion, truncation, overwrite	Moderately imbalanced
AFF4 (Synthetic)	30,000	Structured and unstructured classes	512 bytes	Out-of-order, split streams, truncation	Approximately balanced

The combined dataset includes fragments from multiple file categories (e.g., documents, images, executables, logs, and compressed files) and serves as ground-truth labels for supervised learning. These labels are used exclusively for training and evaluation and are not included in the input feature representation.

The class distribution reflects realistic forensic scenarios, where certain categories (such as documents and logs) are more prevalent than others (e.g., executables or compressed files). In particular, the Digital Corpora subset exhibits moderate class imbalance, whereas the synthetic AFF4 dataset is approximately balanced. This combination allows us to evaluate model performance under both balanced and imbalanced conditions.

Table 12 presents the d dataset partition statistics under group-aware splitting.

Table 12. Dataset partition statistics under group-aware splitting.

Subset	Groups	Fragments	Class Balance Deviation (%)
Training	42	52,500	2.8
Validation	9	11,250	3.1
Testing	9	11,250	3.4

To ensure a valid and unbiased evaluation, the dataset is partitioned into training (70%), validation (15%), and testing (15%) subsets using a group-aware splitting strategy:

• All fragments originating from the same source (file or disk image) are assigned exclusively to a single subset.
• No fragments from the same logical unit appear across multiple splits.
• This prevents near-duplicate samples and shared contextual information from introducing data leakage or artificially inflating performance.

Within each subset, class distributions are approximately preserved to maintain representativeness. All splits are generated using a fixed random seed to ensure reproducibility.

The inclusion of both real-world and synthetic datasets enables comprehensive evaluation under diverse fragmentation conditions, ranging from naturally occurring file system fragmentation to controlled simulation of non-contiguous, disordered, and degraded data layouts. This ensures that the proposed model is assessed under both practical and challenging forensic scenarios while maintaining strict experimental integrity.

4.7. Implementation Configurations and Requirements

PatternMiner is implemented in a Python-based deep learning environment and trained using both real-world and synthetic forensic datasets. The implementation is designed to ensure reproducibility, scalability, and strict adherence to explicit-leakage-controlled experimental practices. Table 13 summarizes the hardware, software, and training configurations.

Table 13. Hardware, software, and training configurations for PatternMiner implementation.

Component	Specification
Software Environment
Programming Language	Python 3.10
Deep Learning Framework	PyTorch 2.1
Supporting Libraries	NumPy 1.24, Scikit-learn 1.3.2, Matplotlib 3.8
Hardware Setup
CPU	AMD Ryzen 9 7950X, 16-core, 4.5 GHz
RAM	64 GB DDR5
GPU	NVIDIA GeForce RTX 4090, 24 GB VRAM
Operating System	Ubuntu 22.04 LTS
Training Configuration
Batch Size	64
Learning Rate	$1\times {10}^{-4}$ (Adam optimizer)
Dropout Rate	0.3 (fully connected layers)
Fragment Length	512 bytes
Embedding Dimension	16 (byte-level encoding)
Data Split Strategy	Group-aware (file/disk-level partitioning)
Training Epochs	Up to 50 with early stopping (patience = 7)
Loss Function	Categorical cross-entropy

The architecture of PatternMiner is designed to address the challenges posed by fragmented and heterogeneous digital evidence through a hybrid deep learning approach. The model operates on a multimodal input representation comprising byte-level content embeddings and metadata features, explicitly excluding any label-derived attributes.

Convolutional layers extract localized patterns from byte sequences, enabling the detection of structural signatures such as headers and encoding markers. LSTM layers model sequential dependencies within metadata, capturing temporal relationships in access and modification patterns. Transformer encoders complement these components by learning global contextual relationships across disjoint fragments and heterogeneous feature spaces.

This integrated design enables the model to simultaneously capture local structure, temporal dynamics, and long-range dependencies in fragmented digital artifacts.

To enhance generalization, the model is trained using a two-stage strategy:

• Pretraining on synthetically generated fragments to learn generalized structural representations.
• Fine-tuning on real-world forensic datasets (Digital Corpora and AFF4) to adapt to realistic noise patterns.

Throughout training and evaluation, strict safeguards are maintained:

• Input features exclude any direct encoding of the target label.
• Dataset partitioning is performed at the source level to prevent cross-set contamination.
• Performance is evaluated on strictly unseen data.

The architecture can be summarized as:

• CNN layers for localized feature extraction;
• LSTM layers for sequential modeling;
• Transformer encoders for global context modeling;
• Pretraining followed by domain-specific fine-tuning.

Training and Inference Pipeline (Pseudocode)

To enhance reproducibility, we provide structured pseudocode for the complete preprocessing, training, and inference pipeline, in Algorithm 2. The formulation explicitly enforces explicit-leakage-controlled feature construction and group-aware data partitioning.

Algorithm 2 PatternMiner: Reproducible Training and Inference Pipeline

Require: Dataset $\mathcal{D}={(F_i,M_i,y_i,g_i)}_{i=1}^N$        $F_i$: content fragment, $M_i$: metadata, $y_i$: label, $g_i$: group identifier Ensure: Predicted probabilities ${\widehat{y}}_i$   1: Set random seed $s=42$   2: Preprocessing and Feature Construction:   3: for each $(F_i,M_i)\in \mathcal{D}$ do   4:       Normalize metadata (timestamps, size) to $[0,1]$   5:       Encode permissions as binary vectors   6:       Exclude label-derived attributes from input   7:       Pad or truncate $F_i$ to 512 bytes   8:       Embed bytes: ${\mathbf{c}}_i=\mathrm{Embed}\left(F_i\right)\in {\mathbb{R}}^{512\times d}$   9:       Construct input: ${\mathbf{x}}_i=[M_i\Vert \mathrm{Flatten}\left({\mathbf{c}}_i\right)]$ 10: end for 11: Group-Aware Dataset Splitting: 12: Partition $\mathcal{D}$ into train (70 13: Ensure all fragments from the same group remain in one subset 14: Feature Extraction: 15: for each ${\mathbf{x}}_i$ do 16:       ${\mathbf{h}}_i^{\mathrm{cnn}}=\mathrm{ReLU}\left(\mathrm{Conv}1\mathrm{D}\left({\mathbf{x}}_i\right)\right)$ 17:       ${\mathbf{h}}_i^{\mathrm{lstm}}=\mathrm{LSTM}\left({\mathbf{x}}_i\right)$ 18:       $Q={\mathbf{x}}_i{W}_Q,;K={\mathbf{x}}_i{W}_K,;V={\mathbf{x}}_i{W}_V$ 19:       ${\mathbf{h}}_i^{\mathrm{trans}}=\mathrm{softmax}!\left({\displaystyle \frac{Q{K}^{\top }}{\sqrt{d_k}}}\right)V$ 20:       ${\mathbf{h}}_i=[{\mathbf{h}}_i^{\mathrm{cnn}}\Vert {\mathbf{h}}_i^{\mathrm{lstm}}\Vert {\mathbf{h}}_i^{\mathrm{trans}}]$ 21: end for 22: Training: 23: Initialize parameters $\theta$ 24: for epoch $=1$ to E do 25:       for each batch $({\mathbf{x}}_b,y_b)$ do 26:             ${\widehat{y}}_b=\mathrm{softmax}(\mathbf{W}{\mathbf{h}}_b+\mathbf{b})$ 27:             $\mathcal{L}=-\sum y_{b}log\left({\widehat{y}}_b\right)$ 28:             Update $\theta$ using Adam 29:       end for 30:       Validate and apply early stopping if needed 31: end for 32: Inference: 33: for each new input $(F,M)$ do 34:       Apply preprocessing 35:       Compute prediction $\widehat{y}$ 36: end for 37: return ${\widehat{y}}_i$

5. Experimental Evaluation

This section presents a comprehensive evaluation of PatternMiner across multiple forensic reconstruction scenarios. The analysis focuses on three key aspects: (1) the impact of integrating content and metadata representations, (2) the contribution of individual architectural components, and (3) the robustness of the model under degraded and incomplete input conditions. Experiments are conducted on both real-world and synthetic datasets (Digital Corpora and AFF4), and performance is assessed using standard metrics, including accuracy, precision, recall, and F1-score, complemented by ablation studies and comparisons with model variants.

All results reported in this section are obtained under a strictly controlled, explicit-leakage-controlled experimental setup. Specifically, (i) input features exclude any label-derived attributes, such as file type, and (ii) dataset partitioning is performed using a group-aware strategy at the source level (file or disk image). This ensures that no fragments from the same logical unit appear across training, validation, and test sets. Consequently, the reported performance reflects the model’s true generalization capability on previously unseen forensic data, rather than benefiting from trivial correlations, shared metadata context, or duplicate samples.

5.1. Input Modality Comparison

Figure 6 compares three input configurations: metadata-only, content-only, and combined input. All results are obtained under an explicit-leakage-controlled evaluation protocol with group-aware partitioning, ensuring that performance reflects generalization to unseen source-level data.

Figure 6. Performance comparison of input modalities.

The combined configuration achieves the highest performance, exceeding 92% accuracy while maintaining balanced precision and recall. This indicates that integrating structural (content) and contextual (metadata) information provides complementary signals that improve classification performance.

The content-only configuration also demonstrates strong performance, confirming that byte-level representations capture discriminative structural patterns even without metadata. In contrast, the metadata-only configuration yields lower performance, reflecting its limited discriminative capacity when used independently. Nevertheless, metadata retains practical value in constrained scenarios, such as log-based analysis or partial evidence reconstruction, where content may be unavailable.

Overall, these results highlight the complementary roles of both modalities: content captures intrinsic structural features, while metadata provides contextual information that enhances interpretability and classification robustness.

5.2. Effect of Neural Architecture

Figure 7 presents F1-scores for different architectural configurations: CNN-only, CNN + LSTM, and the full hybrid model (CNN + LSTM + Transformer). Performance improves progressively with the inclusion of additional components, indicating the benefit of combining complementary modeling capabilities.

Figure 7. F1-score comparison across neural architectures.

The CNN-only model effectively captures localized byte-level patterns but is limited in modeling temporal and global dependencies. Incorporating LSTM layers improves sequential modeling, enabling the system to better capture temporal relationships within metadata and reducing misclassification in sequential contexts.

The full hybrid model achieves the highest F1-scores, with the Transformer component enabling global dependency modeling across disjoint fragments and heterogeneous feature spaces. This contributes to improved performance in fragmented and disordered scenarios, where long-range relationships are critical.

Importantly, all architectural comparisons are conducted under the same explicit-leakage-controlled and group-aware evaluation setting. As such, the observed improvements reflect genuine gains in representation learning and generalization, rather than artifacts of data leakage or shared context across splits.

5.3. Evaluation of PatternMiner

PatternMiner was evaluated under four input conditions: full input (content + metadata), content-only, metadata-only, and corrupted input (20% byte substitution). Performance was assessed using accuracy, precision, recall, and F1-score, including both macro- and weighted-averaged metrics (Table 14). All experiments were conducted under explicit-leakage-controlled protocol with group-aware dataset partitioning, ensuring that evaluation reflects generalization to unseen source-level data.

Table 14. Performance Metrics for PatternMiner Under Various Input Conditions.

Input Condition	Accuracy (%)	Precision (%)	Recall (%)	F1-Score (%)	Macro F1 (%)	Weighted F1 (%)
Metadata + Content	92.1	91.5	92.8	92.1	91.8	92.3
Content Only	84.3	83.2	84.0	83.6	82.9	83.9
Metadata Only	73.7	70.1	71.8	70.9	70.4	71.2
Corrupted Input (20%)	75.2	73.4	76.0	74.7	74.1	75.0

The full-input configuration achieves the highest performance (92.1% accuracy and F1-score), indicating that integrating structural (content) and contextual (metadata) features provides complementary information for fragment classification.

The content-only configuration maintains strong performance, confirming that byte-level representations capture discriminative structural patterns even without metadata. In contrast, the metadata-only configuration yields lower performance, reflecting its limited discriminative power when used in isolation; however, it still captures useful contextual signals that may be valuable in scenarios where content is partially unavailable.

Under corrupted input conditions, the model maintains stable performance (75.2% accuracy), demonstrating robustness to noise and partial data degradation. This behavior suggests that the hybrid architecture can extract resilient features even when input quality is reduced.

Performance consistency across macro and weighted F1-scores indicates balanced classification across classes, including under moderately imbalanced conditions. Additionally, the average inference time remains below 6 milliseconds per fragment, supporting the feasibility of real-time deployment in practical forensic workflows.

Overall, these results demonstrate that PatternMiner effectively handles fragmented, incomplete, and degraded data. Importantly, given the strict explicit-leakage-controlled evaluation protocol, the reported performance reflects the model’s ability to generalize to previously unseen forensic data rather than relying on trivial correlations or shared context.

5.3.1. Class-Wise Performance

To provide a detailed and transparent evaluation of model behavior across different forensic categories, we report class-wise precision, recall, and F1-score. While aggregate metrics (e.g., accuracy and macro-averaged F1) offer an overall performance summary, they may obscure class-specific variations, particularly in imbalanced datasets such as Digital Corpora.

All results are obtained under an explicit-leakage-controlled evaluation protocol with group-aware partitioning, ensuring that performance reflects generalization to unseen source-level data rather than memorization of shared fragments or metadata context.

Table 15 presents classification performance across representative file types spanning multiple categories, including documents (DOCX, PDF), images (JPG), executables (EXE), multimedia (MP4), logs (LOG), compressed files (ZIP), and plain text (TXT). These classes reflect realistic forensic distributions, where certain categories (e.g., documents and text files) are more prevalent than others.

Table 15. Class-wise precision, recall, and F1-score for PatternMiner.

File Type	Precision (%)	Recall (%)	F1-Score (%)
DOCX	94.1	93.0	93.5
PDF	95.6	94.8	95.2
JPG	92.0	92.6	92.3
EXE	90.8	89.9	90.3
MP4	93.2	93.8	93.5
LOG	90.5	89.8	90.1
ZIP	90.9	90.0	90.4
TXT	93.1	92.5	92.8
Macro Average	92.5	92.0	92.1

The results indicate that PatternMiner achieves consistently high performance across most classes, with F1-scores exceeding 90% for structured formats such as PDF, DOCX, and TXT. These file types exhibit strong, consistent byte-level signatures that are effectively captured by the CNN component and reinforced through multimodal integration.

Performance remains stable for multimedia and executable formats (JPG, MP4, EXE), demonstrating the model’s ability to generalize across heterogeneous data types. However, relatively lower scores are observed for ZIP and LOG classes. This can be attributed to their inherent structural characteristics: compressed formats (ZIP) often exhibit overlapping or obfuscated byte patterns, while log files (LOG) are similar to plain text, leading to reduced distinguishability at the fragment level, particularly under fragmentation and corruption.

Importantly, despite moderate class imbalance in the dataset, the gap between high- and low-performing classes remains limited, and no class exhibits severe degradation. This indicates that the model maintains balanced performance across diverse categories and does not disproportionately favor dominant classes.

The class-wise analysis provides quantitative evidence supporting the robustness and generalization capability of PatternMiner across heterogeneous and imbalanced forensic data distributions.

5.3.2. Error Analysis

Although PatternMiner demonstrates strong overall performance, it is important to analyze misclassification patterns to better understand model limitations and guide future improvements. We perform error analysis using a confusion matrix (Figure 8), which captures the distribution of predictions across the primary file classes. The model achieves high accuracy for structured formats such as PDF and DOCX; however, certain systematic confusions are observed.

Figure 8. Confusion matrix of PatternMiner across representative file types.

Key observations include:

• DOCX and PDF: Occasional mutual misclassification is observed, likely due to structural similarities in compressed and container-based formats, which produce overlapping byte-level patterns.
• LOG and TXT: Moderate confusion exists between these classes, reflecting their shared plain-text characteristics and limited structural differentiation at the fragment level.
• ZIP and EXE: Some ZIP fragments are misclassified as EXE, consistent with scenarios where compressed archives contain executable components or share header-like patterns.
• EXE: While slightly more variable, classification remains stable overall, with errors primarily linked to structurally ambiguous fragments.

To further investigate these patterns, a subset of misclassified instances was manually analyzed. Errors were more frequent in fragments exhibiting severe corruption, limited informative content (e.g., very short effective byte sequences), or incomplete metadata. Additionally, fragments derived from compressed or encoded formats exhibited higher uncertainty due to reduced distinguishability.

These findings highlight the inherent difficulty of fragment-level classification in the presence of structural ambiguity and data degradation. They also reinforce the importance of multimodal learning: content provides fine-grained structural cues, while metadata contributes contextual signals that improve robustness.

Future improvements may focus on enhanced embedding strategies, improved handling of highly compressed formats, and the incorporation of interpretability mechanisms (e.g., attention-based analysis) to better understand model decisions in ambiguous cases.

5.3.3. Comparison with Transformer-Only Baseline

To further validate the architectural design of PatternMiner, we implement a transformer-only baseline to assess whether a single-model approach can effectively capture the structural characteristics of fragmented forensic data.

The transformer-only model uses the same input representation as PatternMiner, in which byte-level content and metadata are combined into a unified sequence. It consists of stacked Transformer encoder layers with multi-head self-attention, followed by a fully connected classification head. No convolutional or recurrent components are included, ensuring that the model relies solely on attention mechanisms.

To ensure a fair comparison, both models are trained under identical conditions, including the same datasets, preprocessing pipeline, optimizer, learning rate, and training schedule. All experiments are conducted under an explicit-leakage-controlled protocol with group-aware partitioning, ensuring evaluation on unseen source-level data.

Table 16 summarizes the results.

Table 16. Performance comparison between transformer-only baseline and PatternMiner.

Model	Accuracy (%)	F1-Score (%)	Key Observations
Transformer-only	87.4	86.9	Strong global modeling; limited explicit locality and sequential bias
PatternMiner (Proposed)	92.1	92.1	Integrated modeling of local, sequential, and global dependencies

The transformer-only model achieves competitive performance but consistently underperforms compared to the hybrid architecture. This gap can be attributed to the absence of explicit inductive biases for local and sequential structures. In fragmented forensic settings, where training data is limited and structural patterns are localized, relying solely on attention mechanisms may require the model to implicitly learn multiple dependencies simultaneously.

In contrast, PatternMiner decomposes the learning task across specialized components: CNN layers capture local byte-level structures, LSTM layers model sequential dependencies, and Transformer encoders handle global relationships. This division of modeling responsibilities leads to more efficient representation learning and improved performance under constrained and noisy conditions.

As depicted in Table 17, the PCA-reduced variants improve the performance of both SVM and Random Forest baselines, confirming that high-dimensional concatenated representations can disadvantage conventional classifiers when no dimensionality reduction or feature selection is applied. The MLP baseline further demonstrates that nonlinear deep learning improves over classical models. However, PatternMiner continues to outperform all fairness-enhanced baselines, indicating that the performance gain is not solely attributable to deep nonlinear classification, but also to the proposed architecture’s explicit modeling of local, sequential, and global dependencies.

Table 17. Fairness-enhanced baseline comparison using PCA-reduced classical models and an MLP baseline.

Model	Accuracy (%)	Macro F1 (%)
SVM	81.4	80.2
SVM + PCA	84.7	83.5
Random Forest	79.8	78.6
Random Forest + PCA	82.9	81.7
MLP	87.6	86.9
PatternMiner (full model)	92.1	91.8

5.3.4. Analytical Comparison with Transformer-Only Approaches

Transformer-based architectures have demonstrated strong performance in sequence modeling due to their ability to capture long-range dependencies via self-attention. However, their direct application to fragmented digital forensic data presents several challenges.

Limited Data Availability

Transformer models typically benefit from large-scale datasets to implicitly learn structural patterns. In digital forensics, labeled data is often limited due to privacy and legal constraints, making it difficult for transformer-only models to fully learn local and sequential structures.

Byte-Level Structural Characteristics

Forensic inputs consist of raw byte streams with highly localized structural patterns, such as file headers and compression markers. Transformers do not inherently encode locality, requiring additional data to learn such patterns, whereas convolutional layers provide this inductive bias explicitly.

Fragmentation and Non-Contiguity

Fragmented data introduces disjoint, out-of-order, and incomplete structures. While Transformers can model long-range dependencies, they do not explicitly differentiate between local and global relationships, which may reduce efficiency when both must be learned simultaneously under noisy conditions.

PatternMiner addresses these challenges by explicitly encoding complementary inductive biases. CNN, LSTM, and Transformer components operate jointly to capture local structure, temporal relationships, and global dependencies, reducing reliance on implicit learning.

Overall, this analysis suggests that while transformer-only architectures provide strong global modeling capabilities, hybrid approaches offer a more structured and efficient framework for fragmented forensic data.

5.3.5. Robustness Under Controlled Perturbations

To quantitatively evaluate the robustness of PatternMiner, we conduct controlled experiments under varying levels of input degradation. These experiments simulate realistic forensic conditions where fragments may be partially corrupted, truncated, or structurally incomplete.

Perturbation Protocol

We consider three types of perturbations commonly observed in fragmented forensic data:

• Random Byte Flips: A percentage of bytes within each fragment are randomly modified to simulate noise or bit-level corruption.
• Byte Removal (Truncation): A portion of the fragment is removed at random positions to emulate partial data recovery or overwrite scenarios.
• Header Removal: The initial segment of the fragment (e.g., first 10–20% of bytes) is removed to simulate the loss of structural signatures such as file headers.

For each perturbation type, we vary the corruption level from 0% (clean input) to 30% in increments of 10%. All perturbations are applied uniformly across the test set, and experiments are conducted using the same explicit-leakage-controlled evaluation protocol and group-aware data partitioning described earlier.

Table 18 summarizes the performance of PatternMiner under increasing levels of corruption.

Table 18. Robustness evaluation under varying corruption levels.

Corruption Level	Accuracy (%)	F1-Score (%)
0%	92.1	92.1
10%	85.4	84.9
20%	75.2	74.7
30%	66.8	66.1

To further illustrate the impact of increasing corruption, Figure 9 shows the performance degradation curve in terms of accuracy and F1-score.

Figure 9. Performance degradation of PatternMiner under increasing corruption levels (0–30%).

The results demonstrate a gradual and consistent degradation in performance as corruption increases. Despite this, the model maintains relatively strong performance under moderate noise levels (e.g., 10–20%), indicating resilience to partial data loss and corruption.

The curve in Figure 9 highlights that performance degradation is smooth rather than abrupt, suggesting that the model does not rely on fragile features such as exact byte signatures alone. Instead, it leverages complementary signals across content and metadata.

The hybrid architecture contributes to this robustness: CNN layers capture local structural patterns, LSTM layers model temporal dependencies, and Transformer encoders capture global relationships across fragments. This multimodal integration allows the model to compensate for missing or corrupted information.

Overall, these results provide quantitative and visual evidence that PatternMiner remains effective under realistic forensic perturbations, supporting its applicability in scenarios involving incomplete or degraded digital evidence.

5.4. Ablation Study

We compare metadata-only, content-only, and multimodal configurations. As shown in Figure 10a, the multimodal model achieves the highest performance (92.1% accuracy), indicating that structural and contextual features provide complementary information.

Figure 10. Ablation Analysis.

The content-only configuration maintains strong performance (84.3%), confirming the importance of byte-level features. The metadata-only configuration yields lower performance (73.7%), reflecting its limited discriminative capacity in isolation, though it remains useful in constrained scenarios.

• Effect of Fine-Tuning

We evaluate the impact of domain adaptation by comparing models with and without fine-tuning. As shown in Figure 10b, fine-tuning improves accuracy from 86.8% to 92.1%.

This result highlights the importance of adapting pretrained representations to forensic-specific data distributions, which are often fragmented and noisy.

• Impact of Fragment Length

We analyze the effect of fragment length on performance. As shown in Figure 10c, shorter fragments (256 bytes) reduce accuracy (87.5%) due to limited contextual information. Increasing the fragment length to 512 bytes significantly improves performance (92.1%), while further increasing it to 1024 bytes yields only marginal gains (92.8%) at a higher computational cost. These results indicate that 512 bytes provides an effective balance between performance and efficiency.

The ablation study demonstrates that PatternMiner’s performance depends on the combined contribution of multimodal input, domain-specific fine-tuning, and appropriate fragment granularity.

Additionally, to systematically validate the proposed PatternMiner framework, we conduct a hierarchical ablation analysis that examines the contributions of architectural design, multimodal fusion, transfer learning, and fragment granularity under a unified leakage-aware evaluation protocol. Rather than treating the ablation experiments as isolated analyses, the study is organized progressively to evaluate:

• The validity of the hybrid CNN–LSTM–Transformer architecture;
• The contribution of multimodal forensic fusion;
• The impact of synthetic pretraining and domain-specific fine-tuning;
• The effect of fragment granularity on forensic representation quality.

This hierarchical organization enables a clearer interpretation of how each design component contributes to PatternMiner’s final performance under fragmented forensic conditions.

5.4.1. Validation of Hybrid Architectural Design

The first stage of the ablation analysis evaluates whether the proposed hybrid architecture provides meaningful advantages over isolated or partially combined modeling strategies. This experiment directly validates the central hypothesis underlying PatternMiner: fragmented forensic evidence requires simultaneous modeling of local, sequential, and global dependency structures.

To isolate the contribution of each architectural component, we evaluate multiple architectural variants under identical experimental conditions, including the same datasets, preprocessing pipeline, group-aware partitioning strategy, optimization configuration, and leakage-aware evaluation protocol.

The following architectural configurations are considered:

• CNN only: Captures localized byte-level structural signatures.
• LSTM only: Models sequential and contextual metadata relationships.
• Transformer only: Captures long-range global dependencies across fragments.
• CNN + LSTM: Combines local structural modeling with sequential reasoning.
• CNN + Transformer: Combines local and global dependency modeling.
• LSTM + Transformer: Combines sequential contextual modeling with global reasoning.
• Full Model (CNN + LSTM + Transformer): Proposed hybrid architecture integrating local, sequential, and global dependency modeling simultaneously.

Table 19 summarizes the comparative performance and computational complexity of each architectural configuration.

Table 19. Architectural ablation study and complexity analysis.

Model	Accuracy (%)	Macro-F1 (%)	Parameters in Million	FLOPs in Giga
CNN only	81.6	80.9	∼0.6 M	∼0.4 G
LSTM only	78.4	77.6	∼0.5 M	∼0.3 G
Transformer only	87.4	86.9	∼1.5 M	∼1.1 G
CNN + LSTM	85.7	85.0	∼1.1 M	∼0.8 G
CNN + Transformer	87.2	88.6	∼1.8 M	∼1.2 G
LSTM + Transformer	88.5	87.9	∼1.7 M	∼1.2 G
Full Model	92.1	92.1	∼2.1M	∼1.4 G

The results demonstrate that each architectural component contributes meaningfully to fragmented forensic analysis. The CNN-only configuration effectively captures local byte-level signatures but lacks mechanisms for modeling long-range contextual relationships. Conversely, the LSTM-only configuration models sequential dependencies but cannot robustly recover localized structural signatures in the presence of severe fragmentation. The Transformer-only architecture achieves stronger performance by modeling global relationships across fragments; however, it lacks explicit locality and sequential inductive biases necessary for stable low-level forensic representation learning.

Pairwise combinations improve performance by integrating complementary capabilities. In particular, the CNN + Transformer configuration effectively captures both local and global structures, while the LSTM + Transformer model improves modeling of contextual continuity across fragmented evidence. Nevertheless, none of the pairwise combinations achieves the performance of the full hybrid architecture.

The complete CNN–LSTM-Transformer framework achieves the highest overall performance, confirming that fragmented forensic analysis benefits from jointly modeling local structural signatures, sequential contextual dependencies, and global cross-fragment relationships simultaneously. Importantly, the performance gains remain substantial relative to the moderate increase in computational complexity, indicating that the hybrid design reflects a principled forensic-oriented integration rather than unnecessary over-parameterization.

5.4.2. Contribution of Multimodal Fusion

The second stage of the ablation analysis evaluates the contribution of multimodal forensic fusion. Specifically, we compare metadata-only, content-only, and multimodal configurations to determine whether contextual forensic metadata provides information complementary to byte-level fragment content.

Table 20 summarizes the performance of each modality configuration.

Table 20. Ablation analysis of multimodal forensic fusion.

Input Configuration	Accuracy (%)	Macro-F1 (%)
Metadata only	73.7	72.9
Content only	84.3	83.6
Multimodal (Content + Metadata)	92.1	92.1

The metadata-only configuration yields comparatively limited performance, indicating that contextual metadata alone is insufficient for reliable forensic fragment classification. Nevertheless, the results confirm that metadata retains meaningful contextual forensic information associated with temporal behavior, storage characteristics, and access patterns.

The content-only configuration achieves substantially stronger performance, demonstrating the importance of byte-level structural signatures in fragmented evidence analysis. However, the multimodal configuration consistently outperforms both unimodal alternatives, confirming that contextual forensic metadata and byte-level fragment content provide complementary information.

These results validate the multimodal design hypothesis underlying PatternMiner and demonstrate that jointly modeling structural and contextual forensic evidence improves robustness and classification reliability under fragmented conditions.

5.4.3. Effect of Pretraining and Fine-Tuning

The third stage of the ablation analysis evaluates the impact of synthetic pretraining and forensic-specific fine-tuning. Specifically, we compare models trained directly on forensic data with models initialized via synthetic pretraining on AFF4-derived fragmented data, followed by adaptation to real-world forensic datasets.

Table 21 summarizes the effect of domain adaptation.

Table 21. Effect of synthetic pretraining and forensic-specific fine-tuning.

Training Strategy	Accuracy (%)	Macro-F1 (%)
Without fine-tuning	86.8	86.1
With fine-tuning	92.1	92.1

The results indicate that synthetic pretraining substantially improves downstream forensic performance after adaptation to real-world datasets. This behavior suggests that the pretraining stage enables the framework to learn transferable structural priors associated with fragmented byte patterns prior to exposure to heterogeneous forensic distributions.

Fine-tuning further improves adaptation to the domain-specific characteristics of fragmented forensic evidence, including corruption artifacts, non-contiguous fragment relationships, and heterogeneous metadata structures. The observed improvement demonstrates the importance of transfer learning for stabilizing representation learning under limited and noisy forensic conditions.

5.4.4. Impact of Fragment Granularity

The final stage of the ablation analysis examines the effect of fragment granularity on the quality of forensic representation. Specifically, we evaluate multiple fragment lengths to determine the trade-off between contextual completeness and computational efficiency.

Table 22 summarizes the effect of fragment size on classification performance.

Table 22. Impact of fragment granularity on classification performance.

Fragment Length	Accuracy (%)	Macro-F1 (%)
256 bytes	87.5	86.9
512 bytes	92.1	92.1
1024 bytes	92.8	92.3

Shorter fragments (256 bytes) exhibit reduced performance due to insufficient contextual information and incomplete preservation of structural signatures. Increasing the fragment length to 512 bytes substantially improves performance by preserving more coherent local and global dependency structures.

Although 1024-byte fragments achieve slightly higher accuracy, the improvement is modest compared to the increased computational cost and memory requirements. Consequently, the 512-byte configuration provides an effective balance between forensic representation quality and computational efficiency.

5.4.5. Complexity-Performance Trade-Off

The ablation results additionally demonstrate that the improved performance of PatternMiner is not solely attributable to increased model complexity. Simpler configurations, including CNN-only and pairwise hybrid architectures, achieve lower computational cost but exhibit noticeably weaker robustness under fragmented and corrupted forensic conditions.

In contrast, the proposed hybrid architecture provides a favorable balance between representational capacity and computational practicality. The moderate increase in parameters and FLOPs is justified by substantial gains in classification reliability, multimodal reasoning capability, and robustness to forensic degradation.

The hierarchical ablation analysis demonstrates that the performance gains of PatternMiner do not arise from a single architectural component in isolation. Instead, the results indicate that robust forensic fragment analysis depends on the coordinated interaction of hybrid structural modeling, multimodal contextual integration, transfer learning, and appropriate fragment granularity. The progressive improvement observed across the ablation stages further supports the forensic-specific design rationale underlying the proposed framework.

5.5. Comparison with Baselines

To rigorously evaluate the effectiveness of PatternMiner, we compare it against a range of traditional machine learning and deep learning baselines. All models are implemented and evaluated under identical conditions, including the same datasets, preprocessing pipeline, and group-aware partitioning strategy, ensuring a fair, explicitly leakage-controlled comparison.

5.5.1. Baseline Models and Implementation Details

We consider the following baseline models:

• Support Vector Machine (SVM): RBF kernel with hyperparameters (C, $\gamma$) tuned via grid search.
• Random Forest: 100 trees with maximum depth tuned on the validation set.
• XGBoost: Gradient boosting model with learning rate, number of estimators, and tree depth optimized using validation-based tuning.
• LightGBM: Gradient boosting framework with leaf-wise tree growth and tuned hyperparameters.
• Multi-Layer Perceptron (MLP): Fully connected neural network with two hidden layers and ReLU activations.
• CNN-based model: 1D convolutional network operating on byte-level embeddings.
• LSTM-based model: Sequential model capturing temporal dependencies in metadata and embedded inputs.
• Transformer-only model: Stacked Transformer encoder layers operating on the combined input representation.

Feature Representation: To ensure fairness, all baseline models use the same input representation as PatternMiner. Specifically, content fragments are encoded as fixed-length byte embeddings and flattened into feature vectors, while metadata features (timestamps, file size, and permissions) are normalized and concatenated. No label-derived attributes are included in any model.

Although all baseline models were evaluated with the same input information, we acknowledge that flattened byte-level embeddings are more naturally suited to representation-learning architectures than to traditional machine-learning classifiers. In particular, shallow models such as Logistic Regression or Random Forests cannot explicitly exploit spatial locality, sequential structure, or long-range contextual dependencies within fragmented byte streams.

The purpose of using a shared input representation was therefore not to optimize each baseline individually, but rather to ensure that all models were evaluated under a controlled and comparable information setting. This design isolates differences arising from the learning architecture itself rather than from handcrafted feature engineering tailored to specific baselines.

We note that traditional forensic machine learning approaches often rely on manually engineered features such as byte-frequency statistics, entropy measures, or n-gram representations. Incorporating such task-specific feature engineering for each baseline could improve individual baseline performance, but would introduce additional confounding factors and reduce the comparability of the evaluation framework.

Hyperparameter Tuning: All baseline models are tuned using validation-based grid search or standard optimization procedures. The best-performing configuration on the validation set is selected for final evaluation on the test set.

As shown in Table 23, PatternMiner consistently outperforms all baseline models. Traditional machine learning approaches (SVM, Random Forest, XGBoost, LightGBM) achieve performance in the range of 80–83%, reflecting their limited ability to model high-dimensional, fragmented byte-level data without extensive feature engineering.

Table 23. Performance comparison of PatternMiner against machine learning and deep learning baselines.

Model	Category	Accuracy (%)	F1-Score (%)
PatternMiner (Proposed)	Hybrid DL	92.1	92.1
Transformer-only	Deep Learning	87.4	86.9
ByteBERT-like	Deep Learning	86.5	86.0
Multimodal Transformer	Deep Learning	88.2	87.8
BiLSTM + Attention	Deep Learning	85.0	84.3
CharCNN	Deep Learning	84.0	83.5
LightGBM	Classical ML	83.5	83.0
XGBoost	Classical ML	83.0	82.5
Gradient Boosting	Classical ML	81.4	80.6
Random Forest	Classical ML	82.3	81.5
SVM (RBF)	Classical ML	77.3	76.1
KNN (k = 5)	Classical ML	72.8	71.7
Logistic Regression	Classical ML	74.6	73.0
Naive Bayes	Classical ML	65.4	63.8
DBSCAN	Unsupervised	58.6	57.3
K-Means	Unsupervised	60.3	59.0

Deep learning baselines demonstrate improved performance (approximately 85–88%), highlighting the importance of representation learning for this task. However, single-model architectures remain insufficient for capturing the full complexity of fragmented forensic data.

The proposed hybrid architecture achieves the highest performance (92.1% accuracy and F1-score), demonstrating the benefit of explicitly integrating local (CNN), sequential (LSTM), and global (Transformer) modeling capabilities. This structured combination enables more effective learning of complementary patterns compared to relying on a single architecture to implicitly capture all dependencies.

Overall, these results confirm that PatternMiner provides a robust and generalizable solution for forensic pattern recognition under realistic and challenging conditions.

5.5.2. Statistical Significance of Performance Improvements

To assess whether PatternMiner’s performance improvements over traditional machine learning models are statistically significant, we conducted a one-way Analysis of Variance (ANOVA) test using F1-scores from five independent evaluation runs for each model.

The models compared include PatternMiner, XGBoost, Random Forest, and Support Vector Machine (SVM). The ANOVA results yielded an F-statistic of 3398.02 with a p-value of 1.21 × 10⁻²², indicating a highly significant difference in performance across the tested models.

To visually support these findings, Figure 11 presents a boxplot comparing the F1-score distributions for each model. It is evident that PatternMiner consistently achieves significantly higher F1 Scores with lower variance than all baseline models.

Figure 11. Boxplot of F1-score distributions across PatternMiner and baseline models.

Following the ANOVA analysis, we conducted a Tukey’s Honest Significant Difference (HSD) post hoc test to identify pairwise differences among models. As shown in Table 24, the test confirmed that PatternMiner outperforms all other models with a statistically significant margin (p < 0.001).

Table 24. Tukey HSD post hoc test results for F1-Score comparisons.

Model 1	Model 2	Mean Diff	P-Adj	Lower	Upper	Reject
PatternMiner	XGBoost	8.92	<0.001	8.64	9.20	True
PatternMiner	Random Forest	11.04	<0.001	10.76	11.32	True
PatternMiner	SVM	13.60	<0.001	13.32	13.88	True
XGBoost	Random Forest	2.12	<0.001	1.84	2.40	True
XGBoost	SVM	4.68	<0.001	4.40	4.96	True
Random Forest	SVM	2.56	<0.001	2.28	2.84	True

This statistical analysis confirms that PatternMiner’s superior F1 score is not due to random variation but rather represents a consistent and meaningful improvement. These findings reinforce the robustness and reliability of the proposed deep learning framework for forensic pattern recognition.

5.6. Metadata Influence

In fragmented forensic environments, metadata often serves as a critical source of information when file content is missing, encrypted, or severely corrupted. To better understand how metadata contributes to PatternMiner’s classification decisions, we analyzed the learned weight distributions for key metadata features, including temporal attributes (e.g., access and modification timestamps), file size, and permission indicators.

Importantly, all metadata features considered in this analysis are strictly limited to intrinsic attributes. Any label-derived information, such as file type, is explicitly excluded from the input representation to prevent leakage and ensure a valid evaluation of model behavior.

The analysis reveals that the model consistently assigns higher importance to temporal features, particularly the last modification timestamp, followed by the access timestamp. These features exhibit strong influence across validation samples, indicating that temporal patterns provide meaningful contextual signals for fragment classification, especially when content-based features are incomplete or degraded.

As illustrated in Figure 12, file size and permission indicators also contribute to the model’s decision-making process, although with relatively lower importance. This distribution reflects the complementary role of metadata: while structural content remains the primary signal, contextual metadata enhances robustness by capturing usage patterns, access behavior, and system-level characteristics.

Figure 12. Relative importance of explicit-leakage-controlled metadata features as learned by the model. File type and other label-derived attributes are excluded from the input representation.

These findings confirm that PatternMiner leverages metadata in a principled and explicit-leakage-controlled. The model relies on intrinsic contextual signals rather than explicit class identifiers, ensuring that performance reflects genuine pattern recognition. Additionally, the interpretability of metadata contributions supports forensic transparency, which is essential for auditability and evidentiary reliability in investigative workflows.

• Feature Importance Estimation

The normalized feature importance values presented in Figure 10 were computed using a permutation-based importance analysis. Specifically, each input feature was randomized independently while keeping all other features unchanged, and the resulting decrease in classification performance was measured on the held-out test set. Features producing larger reductions in predictive performance were assigned higher importance scores.

To facilitate comparison across heterogeneous feature types, the resulting importance values were normalized to the range $[0,1]$ using min-max scaling:

$$I_i^{norm}={\displaystyle \frac{I_i-min\left(I\right)}{max\left(I\right)-min\left(I\right)}}$$

(24)

where $I_i$ denotes the raw importance score associated with feature i.

The resulting normalized scores therefore reflect the relative contribution of each feature to the model’s overall predictive performance rather than its direct causal influence.

• Interpretation of Timestamp Dominance

As illustrated in Figure 12, timestamp-related metadata features exhibited comparatively high importance scores. This behavior is consistent with practical forensic environments, where temporal metadata often captures meaningful contextual information regarding system activity, file access behavior, and modification patterns.

In fragmented forensic settings, byte-level structural signatures may become partially corrupted or incomplete due to deletion, truncation, or overwrite operations. Under such conditions, temporal metadata can provide stable contextual cues that help the model distinguish among fragment categories. For example, log files, temporary files, executables, and user-generated documents often exhibit distinct access and modification patterns that align with typical system and user workflows.

Importantly, the observed importance of timestamp features does not imply that timestamps alone determine the target classes. Metadata-only baseline experiments produced substantially lower performance than the full multimodal framework, indicating that timestamp information serves primarily as complementary contextual evidence rather than a direct class identifier. The strongest performance was achieved only when temporal metadata was jointly modeled with byte-level fragment content.

5.6.1. Model Complexity and Computational Efficiency

In addition to accuracy and robustness, the practical feasibility of deploying PatternMiner in real-world forensic environments depends heavily on its computational footprint. While deep learning models often yield superior performance, their complexity can become a bottleneck for real-time or resource-constrained forensic investigations.

Table 25 compares the model complexity of PatternMiner with several baseline machine learning models, XGBoost, Random Forest, and SVM, in terms of approximate trainable parameter count and inference-time Floating-Point Operations (FLOPs). These metrics provide a quantitative perspective on computational scalability.

Table 25. Model complexity comparison: parameter count and inference cost.

Model	Parameter Count	FLOPs per Inference
PatternMiner (CNN + LSTM + Transformer)	~2.1 million	~1.4 GFLOPs
XGBoost	~100,000	~5 MFLOPs
Random Forest (100 trees, depth = 10)	~50,000	~8 MFLOPs
SVM (RBF Kernel)	Varies with support vectors	~15 MFLOPs

As the table shows, PatternMiner’s hybrid architecture, convolutional layers for structural pattern extraction, LSTM layers for modeling temporal context, and Transformer encoders for global attention, yields a significantly larger parameter space. Nonetheless, it remains computationally viable for deployment. With optimized inference paths and hardware acceleration (e.g., GPU or edge AI chips), PatternMiner maintains an average processing time of under 6 milliseconds per fragment.

By contrast, XGBoost and Random Forest models offer lightweight alternatives with lower computational costs. However, they lack the deep representational capacity to accurately interpret fragmented and heterogeneous digital evidence. Support Vector Machines, while efficient, also fall short when faced with high-dimensional, sequential inputs without extensive feature engineering. In summary, PatternMiner achieves a well-balanced trade-off: while it is more complex than traditional models, its design supports fast inference and significantly improved pattern recognition in forensic tasks. This balance makes it suitable for integrating into digital forensic workflows where precision and responsiveness are essential.

5.6.2. Model Explainability Through Visual Interpretation

We explored how PatternMiner’s decisions can be visually interpreted using explainability techniques to support forensic transparency and increase trust in the model. Specifically, we applied attention heatmaps and saliency maps to highlight which byte regions or metadata components contributed most to the classification decision.

Attention Heatmaps

The Transformer encoder within PatternMiner learns to model global dependencies across fragmented inputs. We visualized the internal attention weights to produce a heatmap that shows how much attention each Transformer head assigns to different byte positions. As shown in Figure 13, subfigure (a) reveals a clear focus on the early-byte regions of a fragment, often corresponding to format-specific signatures such as ZIP headers or XML tags in DOCX/PDF files. This confirms the model’s ability to associate byte-level structure with semantic patterns even in fragmented evidence.

Figure 13. Model interpretability through visual mappings. (a) Attention heatmap from the Transformer component, highlighting byte positions with greater focus. (b) The CNN component’s saliency map shows regions of the fragment that have a stronger influence on the model’s decision.

Saliency Maps

We applied gradient-based saliency visualization to the CNN component to further interpret local decision behavior. Subfigure (b) in Figure 13 illustrates the most influential byte regions concerning the output classification score. These saliency regions correspond to embedded metadata or structural markers, thereby providing forensic investigators with traceable evidence paths from the prediction to the input features.

Metadata Influence

We also analyzed the weight distributions across metadata inputs. Features such as access time consistently exhibited high activation values, particularly in cases with limited or corrupted content. This underscores the complementary role of metadata in reinforcing the context of fragments.

These visualizations demonstrate that PatternMiner’s deep learning model is not a black box. Instead, it offers interpretable evidence mapping, making it suitable for forensic applications where results must be transparent and reproducible.

5.7. Efficiency Analysis: Runtime, Resource Utilization, and Scalability

In addition to predictive performance, we evaluate PatternMiner’s computational efficiency on both CPU and GPU platforms to assess its practicality for real-world forensic deployment. Since forensic workflows often operate under resource constraints, a comprehensive analysis of runtime, memory consumption, and scalability is essential.

5.7.1. CPU Runtime Performance

We first evaluate inference efficiency under CPU-only conditions, reflecting typical forensic deployment scenarios. Experiments were conducted on a workstation with an AMD Ryzen 9 7950X and 64 GB DDR5 RAM.

As illustrated in Figure 14, PatternMiner achieves an average inference latency of 5.8 ms per fragment, corresponding to a throughput of approximately 172 fragments/s. While classical models exhibit lower latency (2–3 ms), their predictive performance is significantly lower. In contrast, transformer-based models incur higher latency (9–11 ms) due to the computational overhead of self-attention. PatternMiner provides a balanced trade-off, maintaining strong predictive performance while remaining efficient for near-real-time analysis.

Figure 14. CPU runtime comparison of PatternMiner and baseline models.

5.7.2. GPU Resource–Performance Trade-Off

We next analyze the relationship between GPU memory consumption and predictive performance across architectural configurations. Figure 15 shows that the full PatternMiner model achieves the highest F1-score (0.92) while requiring approximately 12 GB of GPU memory, compared to 6 GB for the CNN + LSTM model and 2 GB for the CNN-only baseline.

Figure 15. GPU memory usage versus F1-score across model configurations.

These results highlight a trade-off between predictive accuracy and computational cost. While the hybrid architecture introduces additional overhead, the performance gains are meaningful in forensic contexts, where even modest improvements can significantly enhance evidentiary reliability.

5.7.3. Latency–Performance Trade-Off

Figure 16 further illustrates the relationship between inference time and predictive performance. PatternMiner achieves the highest F1-score with only a moderate increase in inference time compared to lighter models, demonstrating its suitability for time-sensitive forensic applications.

Figure 16. Inference time versus F1-score across model configurations.

5.7.4. Scaling with Fragment Length

To evaluate scalability, we analyze how inference latency varies with fragment length. As shown in Figure 17, latency increases with input size due to the combined effects of convolutional, recurrent, and attention-based computations.

Figure 17. Inference latency as a function of fragment length under CPU execution.

Shorter fragments (256 bytes) yield lower latency but reduced contextual information, whereas larger fragments (1024 bytes) incur higher computational cost with marginal accuracy gains. The selected fragment size of 512 bytes provides an effective trade-off between performance and efficiency.

5.7.5. Computational Complexity and Convergence

The computational cost of PatternMiner is determined by its hybrid architecture. Let n denote fragment length, d the embedding dimension, h the hidden size, and k the convolution kernel size. The convolutional component has complexity $O\left(nkd\right)$, the LSTM contributes $O\left(n{h}^2\right)$, and the Transformer encoder introduces $O\left(n^{2}d\right)$ complexity due to self-attention. The overall inference complexity is therefore:

$$O(nkd+n{h}^2+n^{2}d).$$

Training complexity follows a similar pattern, yielding:

$$O(T·(nkd+n{h}^2+n^{2}d)),$$

where T is the number of training samples.

Empirically, PatternMiner demonstrates stable convergence, typically reaching optimal validation performance within 15–20 epochs. The inclusion of convolutional and recurrent components provides strong inductive biases that accelerate learning and reduce reliance on large-scale datasets, resulting in faster convergence than transformer-only models.

5.7.6. Memory and Energy Efficiency

Memory usage scales linearly for convolutional and recurrent components and quadratically for the attention mechanism ($O\left(n^2\right)$). Under the selected fragment size, this overhead remains manageable on standard hardware.

From an energy and computational cost perspective, PatternMiner avoids the excessive overhead associated with large transformer-only models. Its hybrid design enables moderate CPU utilization and efficient execution, making it suitable for deployment in resource-constrained forensic environments.

Overall, PatternMiner achieves a favorable balance between predictive performance and computational efficiency. Its hybrid architecture supports efficient inference, scalable behavior across fragment sizes, and stable training convergence, while maintaining practical resource requirements for both CPU- and GPU-based forensic workflows.

6. Discussion

The experimental results demonstrate that PatternMiner provides a promising approach for analyzing fragmented and heterogeneous digital evidence under realistic forensic conditions. This section interprets the findings with an emphasis on generalization, methodological validity, and practical applicability, while also discussing limitations and potential risks.

6.1. Strengths of Deep Learning for Fragmented Forensic Evidence

The proposed hybrid architecture, integrating CNNs, LSTMs, and Transformer encoders, proves effective in modeling fragmented and disordered digital data. Under the explicit-leakage-controlled evaluation protocol, PatternMiner achieves strong performance (e.g., 92.1% accuracy with combined inputs), indicating its ability to learn meaningful structural and contextual patterns without relying on explicit identifiers.

The results highlight the benefit of multimodal fusion: content-based features capture intrinsic byte-level structures, while metadata provides complementary contextual information. Their integration leads to improved performance compared to single-modality inputs, particularly when evaluated on previously unseen source files.

The inclusion of attention mechanisms further enhances the model’s capability to capture long-range dependencies across disjoint fragments. This is especially important in forensic scenarios where logical relationships are not preserved in physical storage. Overall, the findings suggest that deep learning models can effectively generalize to complex forensic conditions when designed and evaluated under strict explicit-leakage-controlled constraints.

6.2. Limitations

Although the current experimental evaluation focuses on a subset of commonly encountered forensic file categories, the proposed PatternMiner framework is not inherently restricted to these file types. Since the architecture operates directly on byte-level fragments and generic metadata representations, additional forensic artifacts such as SQLite databases, CSV/XML/JSON documents, PST/EML email containers, compressed archives (e.g., 7Z), browser storage files, and registry-related artifacts can be integrated without architectural modification.

The current study intentionally constrained the number of file categories to maintain balanced class distributions and enable controlled evaluation under fragmented conditions. Expanding the dataset to include a broader range of forensic-specific file types constitutes an important direction for future work, particularly for enterprise-scale and incident-response investigations involving heterogeneous evidence sources.

Despite these strengths, several limitations should be considered. First, deep learning models require sufficiently large and diverse labeled datasets, which remain challenging to obtain in digital forensics due to privacy, legal, and availability constraints. While the use of synthetic data partially mitigates this issue, it may not fully capture the variability of real-world forensic environments.

Second, the complexity of the hybrid architecture poses interpretability challenges. In forensic applications, model decisions must often be explainable and defensible in legal contexts. Although techniques such as saliency maps and attention visualization can provide partial insights, achieving full transparency remains an open research problem.

Third, while group-aware partitioning reduces data leakage, the model may still be influenced by dataset-specific characteristics or class imbalance. Further evaluation on larger and more diverse datasets is necessary to fully assess generalization across different forensic contexts.

While PatternMiner demonstrates strong performance in fragment-level classification, it does not address the problem of complete file recovery. Full reconstruction requires additional steps such as fragment grouping, sequence inference, and structural validation, which are beyond the scope of this work.

Finally, practical deployment may be constrained by computational requirements, particularly in resource-limited environments such as field investigations or embedded forensic systems.

6.3. Robustness to Obfuscation and Degraded Inputs

PatternMiner demonstrates robustness under degraded conditions, including scenarios with 20% byte-level corruption, where performance remains stable (e.g., 75.2% accuracy and 74.7% F1-score). This suggests that the model captures resilient structural patterns that are not overly sensitive to localized noise or partial data loss.

Additionally, the ability to operate in content-only or metadata-only configurations highlights the model’s adaptability when evidence is incomplete or partially obfuscated. This is particularly relevant in real-world forensic investigations, where adversarial manipulation, data corruption, or missing artifacts are common.

Importantly, these robustness results are obtained under explicit-leakage-controlled evaluation conditions, indicating that the model’s performance is driven by intrinsic feature learning rather than reliance on trivial correlations or shared context.

Overall, the findings indicate that PatternMiner provides a robust and scalable framework for forensic pattern recognition in fragmented environments. By combining complementary inductive biases and enforcing strict evaluation protocols, the model achieves strong performance while maintaining methodological validity. However, future work is required to address challenges related to data availability, interpretability, and deployment in resource-constrained settings.

6.4. Limitations Under Anti-Forensic Manipulation

The current robustness evaluation focuses on controlled corruption and fragmentation conditions rather than deliberate anti-forensic manipulation.

Although the proposed framework demonstrates robustness under controlled fragmentation and corruption conditions, the current evaluation primarily addresses passive degradation scenarios rather than deliberate anti-forensic manipulation. Specifically, the corruption model considered in this study focuses on stochastic byte perturbation, truncation, shifting, and fragment disordering designed to simulate realistic storage fragmentation and partial data degradation.

More sophisticated anti-forensic behaviors commonly encountered in adversarial environments, including secure data wiping, intentional fragment interleaving, encryption-based obfuscation, metadata falsification, and adversarial byte manipulation, were not explicitly modeled in the current experimental framework. Such attacks may significantly alter or suppress both structural byte-level signatures and contextual forensic metadata, thereby introducing substantially more challenging inference conditions.

Nevertheless, several architectural characteristics of PatternMiner may provide partial resilience under adversarial forensic scenarios. The CNN component captures localized residual signatures that may persist despite partial overwriting, while the Transformer-based global dependency modeling can potentially associate weak or disjoint structural relationships across fragmented evidence. Additionally, multimodal metadata integration may preserve contextual forensic cues even when content-level structures become partially degraded.

However, comprehensive evaluation under intentional anti-forensic manipulation remains an open research problem and constitutes an important direction for future work. In particular, future extensions should investigate robustness to encrypted fragments, secure-wiping artifacts, adversarial perturbations, metadata spoofing, and cross-fragment obfuscation strategies within realistic forensic threat models.

7. Conclusions and Future Work

This paper presented PatternMiner, a hybrid deep-learning framework designed to address the challenge of recognizing forensic patterns in fragmented digital evidence. By integrating CNNs, LSTM networks, and Transformer encoders, the proposed approach overcomes key limitations of traditional forensic tools that rely on intact files or rule-based analysis. The framework leverages multimodal fusion of byte-level content and contextual metadata to enable robust inference in scenarios involving incomplete, disordered, or corrupted data.

Experimental results, obtained under a strictly explicit-leakage-controlled evaluation protocol, demonstrate that PatternMiner achieves strong and consistent performance across diverse forensic conditions. In particular, the combination of content and metadata provides measurable improvements over single-modality inputs, while the hybrid architecture enhances the model’s ability to capture local, sequential, and global dependencies. These findings indicate that the proposed framework can learn meaningful forensic patterns and generalize to previously unseen data, rather than relying on trivial correlations or dataset-specific artifacts.

The strengths of PatternMiner lie in its multimodal learning capability, its robustness under degraded input conditions, and its alignment with realistic forensic scenarios. The incorporation of attention mechanisms enables the modeling of long-range dependencies in fragmented data, while interpretability techniques such as saliency maps and attention visualizations provide partial insight into model behavior. Together, these features position PatternMiner as a promising tool to support forensic analysis in complex, data-constrained environments.

Despite these contributions, several limitations remain. First, the framework relies on the availability of labeled forensic datasets, which are often limited by privacy, legal, and operational constraints. Second, although interpretability is partially addressed, achieving fully transparent and legally defensible explanations remains an open challenge. Third, the computational requirements of the hybrid architecture may limit deployment in resource-constrained or field-based environments. Additionally, while group-aware partitioning mitigates data leakage, further validation on larger and more diverse datasets is necessary to fully assess cross-domain generalization.

This work contributes to both forensic practice and research. For practitioners, PatternMiner provides a systematic approach to analyzing fragmented and incomplete digital evidence, potentially improving the efficiency and reliability of investigations. For researchers, it establishes a foundation for integrating multimodal deep learning techniques into forensic workflows, highlighting the importance of combining structural and contextual information while adhering to rigorous evaluation protocols.

Several directions for future work emerge from this study. Enhancing explainability through advanced XAI methods, such as counterfactual reasoning, attribution techniques, and logic-based explanations, can improve interpretability and legal admissibility. Reducing reliance on labeled data through transfer learning, self-supervised learning, and few-shot approaches will expand applicability in data-constrained settings. Extending the framework to support the temporal reconstruction of events from unordered fragments represents another promising direction. Furthermore, optimizing the model through compression, quantization, and edge-deployment strategies will enable real-time analysis in resource-constrained environments. Finally, adapting the framework to domain-specific contexts, such as cloud forensics, IoT ecosystems, and mobile devices, will further broaden its applicability.

In summary, PatternMiner represents a step toward more robust and generalizable digital forensic systems capable of handling fragmented and heterogeneous evidence. By combining complementary modeling techniques with strict evaluation practices, the proposed framework advances the development of data-driven methodologies in digital forensics while highlighting important challenges for future research.