llm-forensic-timeline

Standardized evaluation of LLM-based digital forensic timeline analysis.

This package implements the methodology of the DFRWS APAC 2025 paper Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysis. It covers the two halves of that methodology:

• Run. Upload a log2timeline/Plaso CSV timeline to an LLM, replay the prompts of a task, and save every answer the model generates.

• Evaluate. Score those answers against a manually validated ground truth with BLEU, ROUGE, and BERTScore, and write one CSV row per file.

The forensic timeline dataset and ground truth are published separately on Zenodo.

Contents:

• Installation
  • From PyPI
  • From source
  • Dataset
  • API key
• Quick Start
  • Send a timeline to the LLM
  • Score the answers
  • From Python
• Detailed Usage
  • Command line reference
  • Prompt files
  • Ground truth formats
• Evaluation Metrics
  • BLEU and ROUGE
  • BERTScore
  • Reading the columns
• API Reference
  • llm_forensic_timeline.metrics
  • llm_forensic_timeline.evaluation
  • llm_forensic_timeline.runner
  • llm_forensic_timeline.cli
• Changelog
  • 0.0.2
• License

Indices and tables

• Index

• Module Index