## 1 Introduction  
According to National Institute of Standards and Technology (NIST), digital forensics is a subdomain of forensics science that encompasses the acquisition, retrieval, preservation, and analysis of electronic data that can be useful in criminal investigations and prosecutions [1]. These data, crucial for both legal and cybersecurity contexts, can be collected from various types of resources, e.g., computers, mobile phones, cloud services, social media, and Internet of Things (IoT) [2]. Within cybersecurity, digital forensics and incident response focus on the identification, investigation, and remediation of cyberattacks. The deployment of forensics applications in the computing and network elements of modern 5G communication systems offers a dual benefit. It can enhance the monitoring of infrastructure health and significantly boost the system's overall performance by enabling prompt detection and response to malicious activities or abnormal behavior [3]. Nowadays, since most human activities create digital traces due to the wide usage of electronic devices, any crime probably leaves some digital evidence [4]. With this capacity, digital forensics tools are incorporated into the investigation of a broad spectrum of cyber-crime, such as online fraud, cyber-bullying, pornography, cartel screening, and economic competition-related violations [5; 6]. Depending on the nature of the crime, a set of devices must be examined and various digital forensics tools can be utilized to collect digital evidence in a legally acceptable way to be admissible at the court. Thus, different digital forensics models exist based on the timing and nature of the investigation [7]. In particular, the models can be categorized into the following types: _(i)_ proactive (or live) data forensics frameworks, which focus on gathering volatile evidence (RAM, network traffic, active sessions, etc.) from running devices and monitoring the status of computing and network infrastructure to detecting suspicious activities, and _(ii)_ reactive (or traditional) data forensics, which follow the occurrence of a stored or archived event (on a hard drive, etc.) and attempt to create a Chain of Custody (CoC) to link suspects to incidents [8]. The biggest challenge of modern digital forensics frameworks is the efficient analysis of data. Typically, the data volume collected during an incident is large, resulting in time-consuming data preparation and interpretation processes that require considerable human resources. To mitigate this, numerous commercial and open-source forensics tools are designed to support the work of case handlers and Information Technology (IT) specialists in two key areas. First, these tools ensure that the collection and analysis of the digital evidence comply with the legal requirements regarding admissibility, authenticity, completion, reliability, and believability [9]. Second, robust digital forensics applications offer a range of advanced functionalities, such as intelligent keyword searching, visualizations, summaries, and automated reports, which aid case handlers throughout the investigation [10]. However, unlocking the full potential of these capabilities requires IT personnel to follow a rigorous workflow that includes data curation, document indexing, artifact recovery, and image processing [11]. Significantly, these tasks are increasingly integrated into Artificial Intelligence (AI) components of forensics tools, enabling the development of specialized models for identifying criminal activities [12]. Given that many of these high-level processes rely heavily on data science techniques like information retrieval, data mining, pattern recognition [13], image recognition [14], and Natural Language Processing (NLP) [15], they demand substantial computational resources. Consequently, forensics tools require high computational power and storage capacity to process large datasets efficiently, while their resource management remains a challenge [16].