Structured Report Generation using Local LLMs for Chat-Based Digital Forensics

Abstract

Chat conversations are an essential data source in forensic investigations. With the number of chat messages sent and received on a daily basis, manually analysing all these chats is very time-consuming if not impossible. Growing interest exists in leveraging Large Language Models (LLMs) to structure and interpret chat conversations to support investigators with finding relevant messages. Privacy and transparency requirements force LLMs to run locally, on hardware under control of investigative authorities. Our goal in this paper is to evaluate the feasibility of using local LLMs to create structured investigative reports from chat corpora. The results of this study will be used to improve the copilot that we are developing for the Hansken DFaaS platform. We adopt a two-stage prompting framework. In stage 1, we split the long conversations in processable parts and, combined with case information, we use local LLMs to create case-specific summaries. In stage 2, these summaries are combined into a single report. We compare the outcome of five local models with ground-truth output of the cloud model Gemini 2.5 Pro. Results indicate that local LLMs can achieve useful performance in entity and role extraction, but still exhibit gaps in strict citations and chronological consistency. Our findings position local LLMs as triage tools: they can accelerate lead discovery and structure large chat corpora under strict privacy constraints. Their outputs must be treated as provisional and should be used for investigative purposes and explicit validation is required before inclusion in a case report.

Authors 5

1. Ying Dehing

   University of Amsterdam

   Affiliation as printed

   University of Amsterdam, Amsterdam, Netherlands

2. Hans Henseler Aachen Netherlands and Netherlands Forensic Institute

   Netherlands Forensic Institute · University of Applied Sciences Leiden

   Affiliation as printed

   Leiden University of Applied Sciences, Leiden, Netherlands and Netherlands Forensic Institute, The Hague, Netherlands

3. Timo Meconi

   University of Groningen

   Affiliation as printed

   University of Groningen, Groningen, Netherlands

4. Marcel Worring

   University of Amsterdam

   Affiliation as printed

   University of Amsterdam, Amsterdam, Netherlands

5. Harm van Beek

   Netherlands Forensic Institute · Open University of the Netherlands

   Affiliation as printed

   Open University, Heerlen, Netherlands and Netherlands Forensic Institute, The Hague, Netherlands