Forensic-Chat: Dual Forensic Analysis

• Forensic-Chat is a layered discipline combining LLM-assisted investigative support with system-oriented evidence recovery from chat-based communications.
• It leverages live memory forensics, persistent device acquisition, and network/session analysis to extract transient and stored chat data across diverse platforms.
• The approach emphasizes privacy preservation, legal compliance, and expert review to ensure reliable, actionable insights in digital forensic investigations.

Forensic-Chat denotes a convergent area of digital-forensics research centered on chat systems, chat evidence, and chat-mediated investigative support. In one explicit usage, it is defined as a chat-based assistant built on LLMs such as GPT-3.5 and GPT-4 that supports digital forensic activities including artifact understanding, evidence searching, code generation, anomaly detection, incident response, and education (Scanlon et al., 2023). In a second, system-oriented usage, it appears as an architecture for acquiring, filtering, classifying, and triaging sensitive communications from instant-messaging platforms, including end-to-end encrypted applications, while minimizing privacy exposure (Kalikiri et al., 2024). Related work extends this space with long-document keyphrase extraction for grooming and drug-dealing investigations, platform-specific artefact recovery from WhatsApp, Skype, Viber, Teams, Telegram, and other clients, and conversation-level scoring methods for forensic interviewing. This suggests a broader technical category in which Forensic-Chat encompasses the acquisition, reduction, interpretation, and reporting of chat-derived evidence across endpoint, memory, network, and analytic layers (Alves et al., 2023).

1. Definition and conceptual boundaries

The literature assigns Forensic-Chat two closely related meanings. First, it is a conversational assistant for forensic practitioners. The LLM-oriented formulation treats Forensic-Chat as a chat-based assistant for collection, preservation, examination, analysis, and reporting tasks, with intended users including forensic analysts and examiners, incident responders and SOC analysts, educators and students, researchers, and tool developers (Scanlon et al., 2023). Second, it is a forensic system for chat environments themselves. In that usage, the architecture comprises acquisition, parsing, privacy filtering, context classification, triage, reporting, and audit functions for encrypted or high-volume messaging data (Kalikiri et al., 2024).

This duality matters because the research corpus does not restrict chat forensics to a single substrate. The evidentiary object may be a desktop instant messenger, a mobile VoIP client, a Teams PSTN session, a WhatsApp Desktop process image, a Firefox OS web-app trace, or a long investigative conversation requiring keyphrase triage. The analytical object may likewise be message content, attachments, timing, network metadata, participant identity, or conversational productivity. This suggests that Forensic-Chat is best understood as a layered discipline rather than a single tool class (Sgaras et al., 2016).

A common misconception is that chat forensics is synonymous with post-mortem database extraction. The surveyed work shows a wider design space: live process memory dumping, whole-device acquisition, token-mediated cloud escalation, browser and WebRTC telemetry, supervised keyphrase extraction, and LLM-assisted analyst workflows all appear as relevant components, depending on platform and threat model (Wijnberg et al., 2020).

2. Investigative drivers and threat models

A central driver is the migration of insider leaks and criminal coordination toward end-to-end encrypted messaging. One study states that insider leaks via encrypted messengers have increased in frequency and cost, cites surveys indicating that 60% of data breaches are primarily caused by malicious insider threats, and notes that network sniffing and host-based monitoring are largely ineffective for WhatsApp, Telegram, and VPN because traffic content is cryptographically protected in transit and often in storage (Kalikiri et al., 2024). In that setting, the adversary is a user with legitimate access who intentionally or accidentally leaks sensitive organizational information via WhatsApp Desktop on Windows 10.

A parallel law-enforcement problem is the loss of real-time visibility. The WhatsApp interception study argues that conventional smartphone, computer, and network investigations no longer deliver real-time, readable content once E2EE is in place; wiretaps expose encrypted packets, and post-mortem analyses yield historical artefacts rather than contemporaneous insight. The investigative gap is therefore “a continuous stream of live and substantive information” about suspect communications, activity, and associated media (Wijnberg et al., 2020).

The threat surface is not limited to mobile or desktop chat clients. Enterprise collaboration systems extend it to group messaging, private channels, PSTN integrations, and push-to-talk modes. Teams, for example, distributes evidence across Exchange Online, SharePoint Online, OneDrive for Business, Teams Admin Center analytics, and, in Direct Routing deployments, SBC call-detail records, SIP logs, and RTP captures. Walkie Talkie traffic adds a network-observable but Teams-admin-invisible layer (Nicoletti et al., 2021).

A further extension arises from browser-native peer-to-peer exchange. HTML5 zero-configuration services use WebRTC, ICE, STUN, TURN, DTLS-SRTP, Drag-and-Drop, FileReader, and Web Storage to create cloudless, end-to-end encrypted transfer channels with no client installation and often no persistent server-side storage. This broadens Forensic-Chat from application forensics to covert web-based communication analysis (Farina et al., 2015).

3. Acquisition surfaces and artefact classes

Forensic-Chat systems operate across multiple acquisition surfaces. Live memory forensics targets volatile plaintext that exists after decryption but before durable protection or deletion. Privacy Aware Memory Forensics exemplifies this model: it enumerates WhatsApp Desktop processes, selects the process with the highest PID, dumps only that process with ProcDump v10.11, extracts ASCII and UNICODE strings with Strings v2.54, reconstructs candidate messages by newline boundaries, deduplicates near-duplicates above 90% similarity, and sends candidate lines to a BERT-based classifier. The approach explicitly avoids whole-RAM capture and relies on the fact that decrypted message strings can reside transiently in process memory; messages removed from hard disk or chat history can still appear in live RAM and be reconstructed (Kalikiri et al., 2024).

Persistent device acquisition remains a second pillar. Android studies repeatedly show recoverable artefacts in app-private SQLite databases, external-media directories, profile images, and call logs. On rooted Android 4.3, Viber, Skype, and WhatsApp yielded messages, contact details, phone numbers, images, and video files from directories such as /data/com.viber.voip/databases/, /data/com.skype.raider/files/<SkypeID>/main.db, and /data/com.whatsapp/databases/ (Dargahi et al., 2017). Earlier WhatsApp/Viber work reported consistent Android directory structures across Froyo, Gingerbread, and Ice Cream Sandwich, with msgstore.db, wa.db, Viber_messages, Viber_call_log.db, SD-card media paths, and encrypted chat-history backups on memory cards (Mahajan et al., 2013). A broader comparative study across iOS and Android adds Skype main.db, Viber Contacts.data, WhatsApp ChatStorage.sqlite, Tango encrypted databases, and per-platform caches and media folders (Sgaras et al., 2016).

Secure-chat applications complicate this picture but do not eliminate it. ChatSecure stores local copies of exchanged messages and files in two SQLCipher databases, impsenc.db and media.db, under /data/data/info.guardianproject.otr.app.im/, and the passphrase can persist in RAM for the entire execution of ChatSecure after entry. The work shows decryption when the passphrase is known and passphrase extraction from volatile memory when it is not voluntarily disclosed (Anglano et al., 2016).

Network and session acquisition adds a third surface. WhatsApp real-time investigation uses lawful SMS interception, WhatsApp Web session creation by QR pairing, STUN metadata capture for calls, and OSINT on profile photo, “last seen,” and “about” fields (Wijnberg et al., 2020). Firefox OS studies show that Telegram traffic in the tested web-centric environment used HTTP port 80 to telegram.org, with some communication texts, image files, and authentication credentials detectable in network traffic, while other services used HTTPS and exposed mainly endpoints, certificates, and timestamps (Yusoff et al., 2017). Teams Direct Routing adds SBC CDR history, SIP signaling, and RTP stream reconstruction as first-class evidentiary sources (Nicoletti et al., 2021).

Surface	Representative artefacts	Example sources
Live memory	Decrypted message strings, passphrases, transient buffers	(Kalikiri et al., 2024, Anglano et al., 2016)
App storage	SQLite DBs, XML configs, media, avatars, logs	(Dargahi et al., 2017, Mahajan et al., 2013, Sgaras et al., 2016)
Network/session	STUN, SIP, RTP, HTTP/TLS metadata, tokenized links	(Wijnberg et al., 2020, Yusoff et al., 2017, Nicoletti et al., 2021)

This evidentiary diversity undercuts another common misconception: that end-to-end encryption eliminates chat evidence. The surveyed systems consistently show that content, identifiers, or operational metadata can survive in client memory, local databases, browser stores, network side channels, or cloud-linked state even when payload interception is unavailable.

4. Analytical methods for relevance, sensitivity, and conversational value

A defining characteristic of contemporary Forensic-Chat research is the move from raw acquisition to selective, context-aware inference. In Privacy Aware Memory Forensics, candidate message lines are filtered by organizationally defined sensitive keywords and then classified by a BERT-based Sensitive Data Detection Model fine-tuned on a manually curated military dataset. The model performs binary classification between Sensitive (1) and Normal/Personal (0), uses a threshold of 0.5, and achieved $\mathrm{TPR} = \frac{138}{138 + 12} = 0.92$, $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$, and overall accuracy of approximately 95% in the reported offline test. The same description reports precision of approximately 0.986 and recall of 0.92 from the confusion matrix $TP=138, FP=2, FN=12, TN=148$ (Kalikiri et al., 2024).

High-volume conversational triage introduces a different analytic regime. JointKPE++ treats an entire chat log as a long document $D^N$, splits it into non-overlapping 512-token blocks $B^n$, encodes blocks with a BERT-family encoder, concatenates the outputs, applies parallel 1D convolutions for $1 \le i \le k$ with $k=7$, and jointly optimizes ranking and chunking objectives. The reported gains are substantial: on English grooming chats, SpanBERT-JointKPE++ reached F1@50 = 68.03, compared with 14.01 for KeyBERT and 50.68 for Joined BERT-JointKPE; on Portuguese drug-dealing cases, BERTimbau-JointKPE++ reached F1@30 = 22.53, compared with 0.57 for KeyBERT (Alves et al., 2023).

Conversation analysis can also target productivity rather than only relevance. In child forensic interviewing, agenda alignment and lexical entrainment are formalized as $g(r_t) = r_t \cdot \mathcal{A}_\Psi$, $\rho(r_t) = r_t \cdot a_t$, and $$\pi^*(r_t) = \beta \frac{\rho(r_t)}{\|a_t\|} + (1-\beta)\frac{g(r_t)}{\|\mathcal{A}_\Psi\|}$$. The reported correlations with age were lower for agenda and responsiveness metrics than for raw word count: word count $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$0, agenda $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$1, responsiveness $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$2, and combined $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$3 $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$4, all with $\mathrm{TNR} = \frac{148}{148 + 2} = 0.98$5. This indicates that topic-aligned and entrainment-based measures may be less confounded by language development than verbosity alone (Ardulov et al., 2018).

Taken together, these results suggest that Forensic-Chat analytics increasingly prioritize semantic context, long-range conversational structure, and domain-specific salience over naive keyword matching. That trend is especially important when benign and harmful uses share surface vocabulary, or when investigators face very large corpora.

5. LLM-mediated Forensic-Chat and analyst assistance

The explicit LLM formulation of Forensic-Chat treats the system as a chat-based assistant for digital-forensics practitioners. The investigated use cases included artifact understanding, evidence searching, code generation, anomaly detection, incident response, and education, with GPT-4 as the experimental focus and GPT-3.5 noted as the free-tier model with reduced capability (Scanlon et al., 2023).

The reported results are mixed. For artifact understanding, the model could enumerate Windows artefacts such as Event Logs, Prefetch, UserAssist, NTFS metadata, LNKs, and Amcache/Shimcache, but it also overemphasized Windows Event Logs and produced incorrect paths and non-existent tool names. For evidence searching, it generated regex scaffolds and keyword lists, but examples sometimes failed simple tests. For code generation, it produced useful scaffolding for file carving, RAID acquisition, and Volatility integration, yet made assumptions that required human review. For anomaly detection, it detected failed SSH logins and suspicious parent-child relations in some scenarios, but failed to identify Heartbleed correctly in 100 repeated runs: Change Cipher Spec (0x14) appeared 77 times, Handshake (0x16) 19 times, ChangeCipherSpec (0x14) 3 times, Alert (0x15) 1 time, and none matched the correct Heartbeat (0x18) (Scanlon et al., 2023).

The principal limitations are privacy, reliability, and reproducibility. Cloud LLMs were deemed unsuitable for real evidence because the evidence would need to be uploaded to the service, and the study emphasizes non-determinism, knowledge cutoff, hallucinations, and the need for knowledgeable users who can identify incorrect assumptions, inaccuracies, and mistakes. Best-practice guidance therefore shifts toward private or on-prem models, Retrieval-Augmented Generation over vetted forensic knowledge bases, prompt and response versioning, strict audit logging, and sandboxed execution for generated code (Scanlon et al., 2023).

Accordingly, Forensic-Chat in the LLM sense is not a substitute for forensic judgment. Its research role is closer to checklist generation, hypothesis support, parser scaffolding, and documentation assistance than to autonomous evidentiary determination.

6. Privacy, legality, and evidentiary governance

Privacy preservation is not ancillary in Forensic-Chat; it is often a primary design constraint. The privacy-aware memory-forensics architecture reduces scope by dumping only the WhatsApp process rather than full RAM, parsing only human-readable strings, filtering only lines containing sensitive keywords, suppressing personal messages when the context score is below 0.5, and retaining only sensitive messages in alerts. The paper does not provide formal privacy metrics, but explicitly frames privacy preservation in terms of scope reduction and context filtering (Kalikiri et al., 2024).

Legal and compliance constraints appear across the corpus. Privacy Aware Memory Forensics requires employee consent or legal authority appropriate to jurisdiction, role-based access controls, chain-of-custody logging, retention policies, and detailed logging of hashes, timestamps, tool versions, operator identity, and commands used (Kalikiri et al., 2024). The LLM-oriented study similarly warns that cloud evidence upload is generally impermissible, that LLM outputs are not evidence, and that any assistance must be documented, versioned, and reproducible (Scanlon et al., 2023). Teams forensics depends on legal hold, eDiscovery roles, tenant retention settings, and careful control of SBC management and audit trails (Nicoletti et al., 2021).

A recurring evidentiary theme is that acquisition methods themselves can alter the environment. Android rooting, live memory capture, QR-based session hijacking, and volatile-state collection each have distinct soundness implications. Several studies explicitly recommend hashing images or dumps, preserving acquisition logs, and documenting the impact of privileged access or live collection on the target system (Dargahi et al., 2017). Where a paper does not specify hashing or chain-of-custody steps, that omission is itself operationally significant.

An objective treatment of controversy therefore requires two points. First, privacy-preserving and forensic goals are not mutually exclusive, but their balance is implementation-dependent. Second, admissibility does not follow automatically from technical recoverability; integrity, provenance, authorization, and minimization remain decisive.

7. Limitations, misconceptions, and research directions

The literature identifies several persistent limitations. Process-memory approaches depend on plaintext residing in RAM, correct process identification, and timing; app updates can alter process behavior, memory layouts, or string formats and break heuristics (Kalikiri et al., 2024). Android and iOS studies are version-specific: schema changes, encrypted backups, WAL or journal files, and external media behaviors vary across releases (Dargahi et al., 2017). Secure clients such as ChatSecure or Tango show that local encryption can sharply narrow the recoverable set unless passphrases, keys, or volatile secrets are obtained (Anglano et al., 2016).

Another limitation is platform fragmentation. WhatsApp Desktop, Firefox OS Telegram, Android mVoIP apps, Windows Store Facebook and Skype, Teams Direct Routing, and browser-native WebRTC channels all require distinct parsers, acquisition privileges, and validation procedures. This argues against monolithic Forensic-Chat implementations and in favor of modular architectures with app profiles, adaptive parsers, and explicit platform validation. The privacy-aware architecture already proposes app profiles, message hashing, SOC integration, and analyst triage, while the JointKPE++ work shows how long-document extraction can scale to conversations with thousands to over a million words (Kalikiri et al., 2024, Alves et al., 2023).

A final misconception is that automation can remove the need for expert review. The evidence runs in the opposite direction. LLMs require knowledgeable users; keyword systems require contextual disambiguation; endpoint artefacts require careful cross-correlation; and even apparently deterministic fields such as timestamps can be distorted by local clock settings, retention windows, or unsynchronized backups. This suggests that the near-term trajectory of Forensic-Chat lies in analyst-centred augmentation rather than full autonomy.

The stated future directions are correspondingly pragmatic: kernel-level privacy preservation to prevent tools from accessing private data; secure enclaves for on-device inference; differential privacy accounting for model feedback loops; multi-app profiles and adaptive parsers; local LLM integration; improved reproducibility and determinism; and better handling of long, multilingual, and coded conversational corpora (Kalikiri et al., 2024, Scanlon et al., 2023).