Forensic Event Reconstruction Using an Ontology-Based Approach and Large Language Model-Driven Reporting

DOI

10.2991/978-94-6239-828-3_20How to use a DOI?

Keywords

Digital Forensics; Timeline Reconstruction; Ontology; Large Language Models; BLEU/ROUGE; SPARQL

Abstract

Digital forensic investigations generate tens of thousands of artifacts originating from heterogeneous sources. This makes incident timeline reconstruction both time-consuming and error-prone. This study develops and evaluates an automated five-step pipeline for ontology- based digital incident timeline reconstruction. The pipeline is implemented on a public forensic dataset that includes a Windows 11 Enterprise disk image. The preprocessing stage classifies events from Plaso parsers. The ontology produces resource description framework (RDF) which spans three knowledge layers: the criminal knowledge Layer, the system knowledge layer, and the traceability knowledge layer. Ten forensic SPARQL queries are executed to extract key findings. In the final stage, six LLMs with three local models (tinyllama:1.1b, qwen2.5:0.5b, qwen2.5:1.5b) and three cloud-based models (llama-3.1-8b, qwen-2.5- 7b, qwen-2.5-72b) are evaluated across three prompting scenarios using BLEU and ROUGE metrics. The cloud models achieve a mean BLEU/ ROUGE score of 0.3088 compared to 0.1703 for their local counterparts (+81.3%), with cloud inference being approximately 8 faster. Few- shot prompting consistently outperforms both knowledge-augmented and baseline prompts across all cloud models. The findings offer empirical guidance for deploying LLMs in forensic workflows, including a quantifiable privacy trade-off between local and cloud inference.

Copyright

© 2026 The Author(s)

Open Access

Open Access This chapter is licensed under the terms of the Creative Commons Attribution-NonCommercial 4.0 International License (http://creativecommons.org/licenses/by-nc/4.0/), which permits any noncommercial use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

Download article (PDF)

TY  - CONF
AU  - Fitria Nurulhikmah
AU  - Hudan Studiawan
PY  - 2026
DA  - 2026/11/04
TI  - Forensic Event Reconstruction Using an Ontology-Based Approach and Large Language Model-Driven Reporting
BT  - Proceedings of the 2026 11th International Conference on Sustainable Information Engineering and Technology (SIET 2026)
PB  - Atlantis Press
SP  - 224
EP  - 234
SN  - 2589-4900
UR  - https://doi.org/10.2991/978-94-6239-828-3_20
DO  - 10.2991/978-94-6239-828-3_20
ID  - Nurulhikmah2026
ER  -