Structured Report Generation using Local LLMs for Chat-Based Digital Forensics

Chat conversations are an essential data source in forensic investigations. With the number of chat messages sent and received on a daily basis, manually analysing all these chats is very time-consuming if not impossible. Growing interest exists in leveraging Large Language Models (LLMs) to structure and interpret chat conversations to support investigators with finding relevant messages. Privacy and transparency requirements force LLMs to run locally, on hardware under control of investigative authorities. Our goal in this paper is to evaluate the feasibility of using local LLMs to create structured investigative reports from chat corpora. The results of this study will be used to improve the copilot that we are developing for the Hansken DFaaS platform. We adopt a two-stage prompting framework. In stage 1, we split the long conversations in processable parts and, combined with case information, we use local LLMs to create case-specific summaries. In stage 2, these summaries are combined into a single report. We compare the outcome of five local models with ground-truth output of the cloud model Gemini 2.5 Pro. Results indicate that local LLMs can achieve useful performance in entity and role extraction, but still exhibit gaps in strict citations and chronological consistency. Our findings position local LLMs as triage tools: they can accelerate lead discovery and structure large chat corpora under strict privacy constraints. Their outputs must be treated as provisional and should be used for investigative purposes and explicit validation is required before inclusion in a case report.