The proliferation of local Large Language Model (LLM) runners, such as Ollama, LM Studio and llama.cpp, presents a new challenge for digital forensics investigators. These tools enable users to deploy powerful AI models in an offline manner, creating a potential evidentiary blind spot for investigators. This work presents a systematic, cross platform forensic analysis of these popular local LLM clients. Through controlled experiments on Windows and Linux operating systems, we acquired and analyzed disk and memory artifacts, documenting installation footprints, configuration files, model caches, prompt histories and network activity. Our experiments uncovered a rich set of previously undocumented artifacts for each software, revealing significant differences in evidence persistence and location based on application architecture. Key findings include the recovery of plaintext prompt histories in structured JSON files, detailed model usage logs and unique file signatures suitable for forensic detection. This research provides a foundational corpus of digital evidence for local LLMs, offering forensic investigators reproducible methodologies, practical triage commands and analyse this new class of software. The findings have critical implications for user privacy, the admissibility of AI-related evidence and the development of anti-forensic techniques.

翻译：本地大语言模型运行工具（如 Ollama、LM Studio 与 llama.cpp）的普及，为数字取证调查人员带来了新的挑战。这些工具使用户能够以离线方式部署强大的 AI 模型，可能形成调查人员难以发现的证据盲区。本研究针对这些流行的本地 LLM 客户端，开展了一项系统性的跨平台取证分析。通过在 Windows 和 Linux 操作系统上进行受控实验，我们获取并分析了磁盘与内存痕迹，记录了安装痕迹、配置文件、模型缓存、提示历史及网络活动。实验揭示了每种软件中大量此前未被记录的痕迹，显示出证据持久性及存储位置因应用架构不同而存在显著差异。主要发现包括可从结构化的 JSON 文件中恢复明文提示历史、详细的模型使用日志以及适用于取证检测的唯一文件签名。本研究为本地 LLM 的数字证据提供了基础性语料，为取证调查人员提供了可复现的方法论、实用的应急排查命令，并助力分析此类新型软件。研究结果对用户隐私、AI 相关证据的可采性以及反取证技术的发展具有关键意义。