## 1 Introduction  
The escalating complexity and frequency of cyberattacks underscore the critical need for robust and transparent mechanisms in digital forensic analysis and incident response. Intrusion detection systems (IDSs) serve as a pivotal component in identifying anomalous activities within network traffic. While machine learning (ML) and deep learning (DL) models have demonstrated significant capabilities in automating and scaling forensic tasks, their widespread adoption introduces a notable limitation: the lack of interpretability significantly limits the trust and usability of AI models in critical decision-making environments. This \"black-box\" nature is particularly concerning in high-stakes legal and forensic domains, where transparency and accountability are paramount, and where model outputs must be explainable, auditable, and suitable for evidentiary purposes. Without clear justifications for predictions, the deployment of such models risks undermining legal processes and eroding stakeholder confidence. Intrusion detection systems (IDSs) play a critical role in identifying anomalous patterns within network traffic. While machine learning (ML) and deep learning (DL) models have significantly advanced the automation and scalabilityof such tasks, their practical adoption in forensic contexts remains hindered by a key limitation: the lack of interpretability. This \"black-box\" nature limits their usefulness in legal settings, where decisions must be supported by clear, verifiable, and auditable reasoning. Addressing this challenge is essential to ensure the trustworthiness and admissibility of AI-driven forensic tools. This study focuses on the forensic analysis of intrusion detection systems (IDSs), with specific emphasis on the incorporation of explainable artificial intelligence (XAI) to enhance the forensic interpretability of ML-based intrusion detection models. XAI has emerged as a promising approach to address the interpretability challenge by elucidating the underlying logic of model predictions. In forensic applications, these capabilities are essential for expert validation, transparent documentation of investigative reasoning, and adherence to regulatory standards [1]. Among the various XAI techniques, SHAP (SHapley Additive Explanations) and LIME (Local Interpretable Model-Agnostic Explanations) have gained prominence for offering both global and local interpretability. SHAP, grounded in cooperative game theory, assigns consistent and accurate attribution values to features. In contrast, LIME builds local surrogate models that approximate the behavior of complex classifiers, thereby facilitating the understanding of individual predictions [2; 3]. Recent research has sought to bridge the gap between automated intrusion detection and interpretability. For instance, [PERSON] et al. [4] demonstrated the integration of SHAP explanations within IDSs deployed in IoT environments, underlining the relevance of interpretability in decision-making and model trustworthiness. Additionally, a systematic review by [PERSON] et al. [1] highlighted the increasing integration of XAI in IDSs, emphasizing the necessity of transparent and interpretable mechanisms in cybersecurity. Despite these advancements, the adoption of XAI methods in the forensic interpretation of IDS outputs remains limited. To address this gap, the present work proposes a structured methodology to evaluate and compare the forensic utility of two widely recognized XAI techniques, SHAP and LIME, applied to two representative AI-based IDS models: XGBoost, a gradient-boosted decision tree ensemble, and TabNet, a deep learning architecture optimized for tabular data. Both models were trained and validated using the UNSW-NB15 dataset. The analysis examines not only classification performance, but also the consistency, interpretability, and forensic applicability of the explanations produced.