Structural Inference in Undocumented Mobile Databases: A Reproducible Benchmark for Evaluating Agentic Reasoning in Digital Forensics
On the map: LLM agents and tool use → Web, search, and research agents
Abstract (arXiv)
Agentic large language models are increasingly used in digital forensic analysis, yet their ability to infer relational structure inside undocumented mobile application databases remains poorly understood. In forensic contexts, structurally incorrect inferences can yield results that appear plausible while remaining evidentially unsound. This work evaluates agentic structural inference as an isolated capability, treating execution success and structural correctness as distinct evaluation axes. It examines how an agent reconstructs table relationships, linking attributes, and executable join paths when given only a raw database and a natural-language investigative prompt. We apply a fixed, deterministic evaluation pipeline to two contrasting SQLite repositories: Android's SMS database with stable identifier propagation, and Snapchat's database with irregular schemas, ephemeral identifiers, and polymorphic relationships. Using expert-verified SQL ground truth, we evaluate (i) structural correctness of inferred relational links, (ii) execution coherence under multi-table reasoning, and (iii) robustness and failure modes of inferred structure when execution succeeds but relational interpretation diverges from expert ground truth. Evaluation is performed independently of semantic interpretation, with full queries and execution traces provided in the Appendix. Results show that structural inference remains reliable in regular schemas but degrades sharply as schema ambiguity increases, frequently producing structurally plausible yet incorrect joins that execute successfully. These findings clarify where schema-agnostic agentic reasoning can support forensic analysis, how its robustness degrades under realistic schema irregularities, and why additional verification remains essential before inferred relationships can be treated as reliable evidence.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Web, search, and research agents, one of 16 directions in LLM agents and tool use. Builds on 6 of its 26 references that are in the map. First posted on arXiv 21 Aug 2026.
Builds on
6 of 26 references.
References · 6
- 2025Digital Forensics in the Age of Large Language Modelscited by 10
- 2024Automating Pharmacovigilance Evidence Generation: Using Large Language Models to Produce Context-Aware SQLcited by 2
- 2025Towards a standardized methodology and dataset for evaluating LLM-based digital forensic timeline analysiscited by 2
- 2025SHIELD: Securing Healthcare IoT with Efficient Machine Learning Techniques for Anomaly Detectioncited by 1
- 2025SMART-WRITE: Adaptive Learning-based Write Energy Optimization for Phase Change Memorycited by 1
- 2026Evaluating the Reliability of Digital Forensic Evidence Discovered by Large Language Model: A Case Studycited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026CHARLIE: An On-Premise Multi-Agent Retrieval-Augmented Generation System for Evidential Reasoning in Forensic Science
- 2026Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw
- 2026InvestigationWorlds: An Agentic Environment for Legal Investigation
- 2025Hey GPT-OSS, Looks Like You Got It -- Now Walk Me Through It! An Assessment of the Reasoning Language Models Chain of Thought Mechanism for Digital Forensics
- 2026TableSeek: Structure-Preserving Agentic Evidence Seeking over Heterogeneous Table Corpora
- 2025LLM-driven Provenance Forensics for Threat Investigation and Detection
- 2025EMULATE: A Multi-Agent Framework for Determining the Veracity of Atomic Claims by Emulating Human Actions
- 2025Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response