## 2 Background
### Machine Learning (ML)  
The application of ML in the field of DF has given rise to a new discipline known as machine-learning forensics (MLF), which has the capacity to detect criminal patterns, anticipate criminal activities (e.g., where and when crimes are likely to occur), and automate DF investigative procedures. To conduct MLF, an adapted DF framework is required, which must be capable of capturing and analysing data in smart environments--regardless of whether devices in this smart environment are connected to the internet via wired or wireless networking interfaces [12].  
Furthermore, ML is an approach to artificial intelligence (AI) that allows a system to learn on its own from experience and example, rather than from programming. In other words, ML is used to describe a system that continually learns and makes decisions based on data rather than programming [4]. ML is not only utilised for AI goals such as simulating human behaviour but also to minimise human effort and time spent on complex and time-consuming jobs. ML techniques include supervised learning, unsupervised learning, and reinforcement learning.  
Supervised learning is a method of developing AI by training a computer program on labelled input data for a certain output. The model is trained until it recognises the underlying patterns and correlations between the input data and the output labels, allowing it to produce appropriate labelling results when given previously unseen data. Supervised learning excels in classification and regression issues. The goal of supervised learning is to make meaning out of data in the context of a given topic [13]. Supervised learning was proposed by some researchers to improve DFIs in smart environments, as mentioned in Section 3.  
In contrast to supervised learning, unsupervised learning is presented with unlabelled data and is designed to detect patterns or similarities on its own. In other words, unsupervised learning techniques include two types: clustering and association, which find all kinds of unknown patterns in data and help to find features that can be useful for categorisation [13].  
Reinforcement learning is totally different from both supervised and unsupervised ML techniques. The relationship between supervised and unsupervised techniques is the presence or absence of data labelling. However, reinforcement learning is a subfield of machine learning concerned with how intelligent agents should behave in a given environment. When the system being represented is independent and not affected by an external actor, Markov models are utilised [14]. Markov chains are the simplest type of Markov model and are used to represent systems where all states are observable. Markov chains show all possible states. Applications of this type of model include prediction, which is a probabilistic technique that uses Markov models to predict the future behaviour of some variable based on its current state and can be used in many domains.  
However, ML has a substantial influence on DF and has various applications in this sector. These applications can improve the overall efficiency of DFIs by finding trends and patterns, similarities, anomalies, and other characteristics inside digital evidence. Therefore, forensic professionals can produce leads and solve crimes in less time and with fewer resources. These advancements lead to the second major contribution of ML applications, which is a reduction in the cost of a DFI [15].  
Section 3 presents an overview of research papers using ML techniques in DF as proposed by different researchers between 2018 and 2023. Section 4 then presents (in table form) the contribution of ML to the DFI process, in order to identify gaps in the reviewed papers and suggest high-level solutions.