Authors: Cory Hall
DFRWS APAC 2026
Abstract
Safely Building Interoperable Investigation Tools
Investigators and forensic examiners understand their mission problems better than anyone, but historically they have depended on commercial vendors, dedicated software development teams, or research organizations to turn those problems into new technical capabilities. The cost and time required to develop software has often meant that useful ideas remain unimplemented, particularly when a requirement is too specialized or urgent to justify a commercial development cycle.
Agentic AI is rapidly changing this equation. Modern coding agents can dramatically lower the barrier to developing purpose-built software, allowing practitioners with limited software engineering experience to move from a mission problem to a working prototype in hours rather than months. But giving someone an AI coding agent can be a little like giving a new driver a supercar: tremendous capability without appropriate training, engineering discipline, and safeguards can produce unreliable and potentially dangerous results.
This four-hour workshop teaches investigators, forensic examiners, analysts, researchers, and other practitioners how to use agentic AI responsibly to develop digital investigation capabilities. The emphasis is not simply on making an AI agent generate code, but on controlling the development process so that the resulting software is understandable, testable, documented, interoperable, secure, and capable of being evaluated for eventual use in a law-enforcement environment.
The lecture portion introduces modern AI and agentic workflows; GitHub and agentic coding environments; Project VIC International’s open-source development template and agent rules; specification-driven development; testing and validation; and the use of synthetic data during development. Participants will also learn how open semantic standards can prevent newly created tools from becoming isolated data silos. CASE/UCO and Project VIC’s Crimes Against Children Ontology provide common models for representing investigative data, while SOLVE-IT provides structured knowledge about digital forensic objectives, techniques, weaknesses, and mitigations that can inform development and evaluation.
During the hands-on portion, the instructor and attendees will collaboratively identify a digital investigation mission problem, turn it into structured requirements and specifications, and direct an agentic coding system through the creation of a working prototype. Participants will see how requirements, architectural decisions, security constraints, tests, documentation, provenance, and interoperability requirements can be established before and during code generation rather than added as afterthoughts.
Attendees will leave with the open-source Project VIC development template, lecture, and CASE/UCO SDK, plus the resulting prototype and source code, and a repeatable methodology that they can use to explore mission-specific capabilities within their own organizations.
Finally, the workshop will demonstrate how these same principles are being applied across the Project VIC technology ecosystem. Rather than treating AI agents or individual forensic tools as isolated capabilities, Project VIC is designing its tools, APIs, MCP servers, and shared semantic models so that they can be safely composed into larger agentic investigative workflows while preserving human oversight, provenance, validation, and interoperability.
Biography
 Cory Hall serves as Chief Executive Officer and President of the Board of Directors of Project VIC International, a USA-based nonprofit that focuses on providing crimes against children investigators with technical intelligence, analytic frameworks, tools, and education to find and rescue children from sexual exploitation and abuse. Cory’s career was shaped in national security roles spanning cybersecurity and intelligence, where he repeatedly saw the urgent need for stronger capabilities in the ICAC mission. He previously served at the MITRE Corporation as a Group Leader, Project Leader, and Principal Cybersecurity Engineer, leading R&D teams that developed cyber-domain analysis methods, machine learning applications for cybercrime data, and new approaches to digital forensic examination. He holds an M.S. in Cybersecurity and a B.S. in Information Technology, is a U.S. Army veteran, and participates in professional communities supporting high-integrity digital investigations, including INTERPOL-led working groups, the American Academy of Forensic Sciences (AAFS), DFRWS, and SWGDE. Cory is the chair of the Linux Foundation’s Cyber Domain Ontology project.
|