Forensic analysis and privacy implications of LLM mobile apps: A case study of ChatGPT, Copilot, and Gemini

Large-Language Model (LLM) apps allow users to ask questions and receive customized responses based on their prompted inputs. They possess deep language comprehension, human-like text generation capabilities, contextual awareness, and robust problem-solving skills, making them invaluable in various domains (e.g., search engines, customer support, translation). Due to the popularity and easy access of these apps, people tend to use them to help them in their daily tasks. However, when downloaded on mobile phones, these apps access various types of personal data (e.g., account information, location, and device information), including browser cookies, which may be of forensic value. The permissions that these applications request can be abused by developers to over-collect data about their users. Therefore, this paper aims to analyze the data these apps (ChatGPT, Gemini, and Copilot) access and find valuable forensic artifacts, including those that may cause privacy concerns and potential risks and threats associated with their use. It also analyzes the type of data stored when downloaded and accessed through a mobile device. The results show that ChatGPT and Copilot stores conversation data in plain text, along with browser data, on both Android and iOS. Gemini, on the other hand, stores all conversation data, browser data, and images in the cloud, which can be extracted through Google Takeout. • Forensic and privacy analysis of ChatGPT, Gemini, and Co-pilot mobile applications on Android and iOS, as well as the cloud for Gemini. • Chatbot conversations were recovered for ChatGPT, Gemini, and Co-pilot, depending on the platform they are used on. • Location data was accessible within a radius of .5 miles, even with location settings turned off on an iOS device for Gemini and ChatGPT. • Details, including user prompts, browser data, and location data, were recovered from Copilot on an Android device.