Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations

Digital Threats Research and Practice, vol. 6, pp. 1–18

Abstract

Large Language Models (LLMs) have rapidly gained popularity in various fields, including Digital Forensics (DF), where they offer the potential to accelerate investigative processes. Although several studies have explored LLMs for tasks such as evidence identification, artifact analysis, and report writing, fine-tuning models for specific forensic applications remains underexplored. This article addresses this gap by proposing recommendations for fine-tuning LLMs tailored to DF tasks. A case study on chat summarization is presented to showcase the applicability of the recommendations, where us evaluate multiple fine-tuned models to assess their performance. The study concludes with sharing the lessons learned from the case study.

Authors 5

1. Gaëtan Michelet

   University of Augsburg · University of Lausanne

   Affiliation as printed

   Chair for Cybersecurity, University of Augsburg, Augsburg, Germany and School of Criminal Justice, University of Lausanne, Lausanne, Switzerland

   Chair for Cybersecurity, University of Augsburg, Germany and School of Criminal Justice, University of Lausanne, Switzerland

2. Hans Henseler Aachen Netherlands Forensic Institute

   Netherlands Forensic Institute · University of Applied Sciences Leiden

   Affiliation as printed

   Netherlands Forensic Institute, The Hague, Netherlands and Leiden University of Applied Sciences, Leiden, Netherlands

   Netherlands Forensic Institute, The Netherlands and Leiden University of Applied Sciences, The Netherlands

3. Harm van Beek

   Netherlands Forensic Institute · Open University of the Netherlands

   Affiliation as printed

   Netherlands Forensic Institute, The Hague, Netherlands and Open Universiteit, Heerlen, Netherlands

   Netherlands Forensic Institute, The Netherlands and Open Universiteit, The Netherlands

4. Mark Scanlon

   University College Dublin

   Affiliation as printed

   University College Dublin, Dublin, Ireland

   University College Dublin, Ireland

5. Frank Breitinger

   University of Augsburg

   Affiliation as printed

   Chair for Cybersecurity, University of Augsburg, Augsburg, Germany

   Chair for Cybersecurity, University of Augsburg, Germany