## 4 The Impact of MLF on the DFI Process
The most widespread use of intelligent techniques in this field is connected to the creation of new rules or the optimisation of an enabled set of rules. Anomaly detection may be thought of as a conventional clustering and outlier identification problem in terms of intelligent approaches. Because a detected anomaly is not always proof of intrusion and might be attributed to odd, but proper, user behaviour, this strategy typically has a high false alarm rate. Furthermore, ref. [27] proposed a DF analysis system based on natural language processing (NLP) techniques and the blockchain for social media data as a significant source of digital evidence that can support various DFIs; NLP is used for data collection, text analysis, and evaluation, and blockchain is used for securing the analysed data and avoiding any other attacks. Therefore, ref. [28] used a well-structured and realistic dataset to test ML and deep-learning techniques that can be used in the DF analysis process to detect multimedia content manipulations. The dataset was technically validated by convolutional neural networks (CNN) and support vector machine (SVM) algorithms, which concluded that SVM had less processing time than CNN, as one of the goals of incorporating ML techniques into DFI is automating processes and reducing time-consuming work. ML techniques also aim to overcome complexity, consistency, correlation, and data volume, as the evidence is gathered from several sources [29]. Moreover, recent research indicates that ML algorithms are also useful for drone data analysis, by generating judgments and predictions about the likelihood of an event occurring by examining varied datasets with varying volumes. As commonalities between pieces of data may be discovered by clustering common data samples into a single cluster and then visualizing the data clusters, which can then be labelled, it becomes feasible to forecast the trajectories of drones in flight and cluster these as either legitimate flight pathways or compromised ones [30]. Thus, according to the state of the art in applying ML techniques in DFI within smart environments (which mainly involves the initialisation and investigative processes (see Table 1)), ML techniques should be applied more prominently in the readiness processes, acquisitive processes, and concurrent processes of DFI. Readiness processes in smart environments will be improved by applying ML techniques to enable automation and pre-incident prediction and detection. A thorough awareness of the setups and the various data sources and types will also greatly reduce the time necessary for DFIs. The automation of DFR processes will enable the automatic capturing and saving of digital evidence from smart environments, based on pre-defined rules, using a rule-based classifier and association rules. This should provide proactive and preventive methods for automation in such an environment. Furthermore, DFR principles already assure the forensic soundness of the information gathered, making it appropriate for litigation. Therefore, ML techniques can be applied in the DFR process, making use of techniques such as noise-resistant algorithms, support vector machines, and neural networks. By making use of such ML techniques, investigators could deduct the rules of classification from existing and historical datasets and scenarios to learn and train the readiness model. Clustering could then be applied to improve the accuracy of classification and allow the model to make decisions by itself. ML techniques are mainly used for prediction and classification. Therefore, the acquiring and concurrent processes in ISO/IEC 27043:2015 can be automated using ML techniques. This will benefit the readiness and initialisation processes in this set of standards to predict and detect incidents using decision trees and neural networks. On the other hand, the incorporation of ML techniques can be powerful for DFI, but there is also a lack of interpretability and inadequate training data, which may lead to powerless and improperly comprehended models [29].