LLM-Assisted Forensic Analysisof Mobile Application Databases Using Model Context Protocol : A Case Study of AI-Supported Interpretation and Reporting of Forensic Data

Sammanfattning

Digital forensic investigations struggle with the volume and complexity of data extracted from mobile applications. Manually interpreting structured database content is timeconsuming and error-prone. This thesis presents a prototype architecture that uses the Model Context Protocol to connect Large Language Modelswith external forensic tools, enabling assisted interpretation, filtering, and reportingof extracted data. Quantitative tests showed that fully autonomous analysis was unreliable on the larger dataset, where the zeroshot run stagnated and produced incomplete or incorrect results. In contrast, iterative, human guided operation achieved 100% precision and recall across entities, artifacts, and evidence items onboth tested database sizes. Runtime benchmarking showed resource intensive and inconsistent autonomous tool use, with 17 of 20 runs completing successfully. Expert interviews found the system valuable for summarizing complex data and identifying relationships, while emphasizing traceability and manual verification. Overall, the results show that this architecture is effective as a guided assistive tool, reducing early investigative bottlenecks while keeping human oversight.