Hypothesis‑Driven Forensic Email Analysis With Retrieval-Augmented Generation

This thesis investigates hypothesis-driven forensic email analysis, where investigators begin with a natural-language hypothesis and seek emails that support or contextualize it. A retrieval-augmented generation pipeline is designed and evaluated on three 100-email hypothesis-specific subsets derived from the TREC Legal Track Enron collection. The system preprocesses and chunks emails, expands each hypothesis into sparse and dense queries, and retrieves candidate evidence using BM25, dense retrieval, and reciprocal-rank-fusion hybrid retrieval. Retrieved chunks are aggregated at the email level and analyzed by a large language model, which predicts usefulness, extracts evidence spans, and generates explanations. The evaluation considers retrieval precision, recall, and F1, end-to-end usefulness classification, evidence-span faithfulness and supportiveness, reasoning relevance, correctness and clarity, context enrichment, and multi-run stability. Results show that no single retriever is optimal for every hypothesis: BM25 is strongest when evidence contains explicit lexical cues, dense retrieval is more competitive for semantically indirect evidence, and hybrid retrieval is most useful when sparse and dense signals are complementary. The inference stage substantially improves precision, while retrieval remains the main bottleneck. Evidence spans are generally faithful and explanations are mostly relevant and clear, although weak context can lead to over- or under-interpretation. The findings support RAG as an investigative aid rather than an automated substitute for human forensic judgment and motivate corpus-aware query expansion, improved context selection, and larger annotated datasets.