DFIR + AI: Using Local LLMs with DFIR MCP Servers
Brief
After the release of MCP servers for Autopsy ( release blog ) and Cyber Triage ( release blog ), we received requests for how to use only local LLMs instead of public servers. This blog post shows you how to use LM Studio to run local LLMs along with Cyber Triage and Autopsy.
This topic is also relevant for those who want to experiment with AI and enter the DFIR+AI Challenge: Good vs Ugly . This allows you to use your case data without sending data to remote sites.
LM Studio is a free tool that allows you to run local LLM models on your computer. It will download models, load them, and provide the chat interface to them. Thanks to Nanni on the Sleuth Kit Forum for highlighting this was so easy.