ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (Local) Large Language Models

2023/12/22 by Gaëtan Michelet, Michelet, Gaëtan, Frank Breitinger +1 · 8 citations
Computer Science · #Computers and Society (cs.CY) #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences #Natural Language Processing Techniques #Topic Modeling

paper · pdf · doi:10.48550/arxiv.2312.14607

openalex publication_date 2023/12/22 · openalex created_date 2023/12/26 · openalex updated_date 2026/07/28

Abstract

Generative AIs, especially Large Language Models (LLMs) such as ChatGPT or Llama, have advanced significantly, positioning them as valuable tools for digital forensics. While initial studies have explored the potential of ChatGPT in the context of investigations, the question of to what extent LLMs can assist the forensic report writing process remains unresolved. To answer the question, this article first examines forensic reports with the goal of generalization (e.g., finding the `average structure' of a report). We then evaluate the strengths and limitations of LLMs for generating the different parts of the forensic report using a case study. This work thus provides valuable insights into the automation of report writing, a critical facet of digital forensics investigations. We conclude that combined with thorough proofreading and corrections, LLMs may assist practitioners during the report writing process but at this point cannot replace them.

Cited by

• Hey GPT-OSS, Looks Like You Got It -- Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
• Presenting Large Language Models as Companions Affects What Mental Capacities People Attribute to Them
• Large Language Models for Security Operations Centers: A Comprehensive Survey
• ForensicsData: A Digital Forensics Dataset for Large Language Models
• Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis
• Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response
• DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response
• SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges

Related

• ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown
• Digital Forensics in the Age of Large Language Models
• ChatGPT in the Age of Generative AI and Large Language Models: A Concise Survey
• ChatGPT or A Silent Everywhere Helper: A Survey of Large Language Models
• Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis