RETRIEVAL-AUGMENTED GENERATION FOR FORENSIC LEGAL ANALYSIS: INTEGRATION OF UKRAINIAN CRIMINAL CODE WITH MOBILE DEVICE EVIDENCE

Abstract

Digital forensic investigations in Ukraine require analysts to classify mobile device evidence according to the Criminal Code, a process that is time-consuming and requires deep legal expertise. This paper presents the first retrieval-augmented generation (RAG) system for Ukrainian Criminal Code analysis, focusing on Section I (Crimes Against National Security). We construct a database of 9 articles covering treason, espionage, collaboration, and sabotage offenses, and evaluate the system on 60 synthetic forensic scenarios with deterministically-derived ground truth. Our experiments compare four chunking strategies, three multilingual embedding models, and four large language models (both API-based and locally-deployed). The best retrieval configuration achieves MRR of 0.588 using multilingual-e5-large embeddings with part-level chunking. For end-to-end classification, RAG with GPT-4o-mini achieves 54.2% article identification accuracy, outperforming a few-shot prompting baseline (29.2%, p=0.03) but showing no statistically significant improvement over direct LLM prompting (52.1%, p=0.89). We argue that RAG’s primary advantage for forensic applications lies not in classification accuracy but in grounding, transparency, and governance: retrieved legal provisions are traceable and verifiable, the knowledge base can be updated without retraining, and the system supports fully local deployment where evidence cannot leave the organization. Local LLMs achieve 77% of API performance (41.7% accuracy), confirming that on-premise deployment is feasible at reduced accuracy.