Reference navigation
Sign in / AccountSearch reference
The Science of Synthetic Evidence

Synthetic
Forensics

Forensic methods for synthetic media, AI-generated artifacts, provenance, authenticity, and human-AI interaction.

Evidence / identitySF—01
Examine the relationships.
State what the evidence supports.
Technical reference projectVendor neutralReference v1.1.0

What is synthetic forensics?

Synthetic forensics is the systematic identification, preservation, examination, reconstruction, and interpretation of digital evidence involving artificial intelligence systems, synthetic media, AI-generated artifacts, and human-AI interactions.

Evidence may include conversations, application storage, generated files, tool records, and provenance. Start by scoping the question and preserving available sources. A detector score alone does not reconstruct a workflow.

Read the definition, scope, and limitations
Synthetic Forensics banner: a fingerprint transitions into a digital evidence network.
Synthetic Forensics — The science of synthetic evidence.
Questions across the field

Core research areas.

Ten connected areas, from media and source attribution to human interpretation and evidentiary integrity. Each begins with a question that evidence can test.

Explore the research library

Understand the terms behind the evidence.

Read 300 plain-language definitions with practical explanations, related concepts, and primary references. Explore evidence handling, synthetic media, provenance, AI conversations, agents, models, and identity. Filter by a word or evidence field, or follow a stable link to the term you need.

Explore the 300-term glossary

Methods turn terminology into an examination. Research connects the questions across disciplines.

How we evaluate synthetic evidence.

Preserve the sources, establish their history, inspect metadata and system records, analyze content, and test competing explanations. Seek independent corroboration and state what remains unresolved.

Follow the layered evaluation method

A detector output is a signal within an examination. It needs relevant validation and an explained relationship to the claim.

AI Agent Forensics

An agent says it changed a file or sent a report. What evidence supports that claim? Follow the task, tool calls, permissions, and records from the affected system to establish what happened.

Read the AI Agent Forensics guide
Follow the relationships

From an interaction to evidence.

Not every AI platform produces every artifact type. Availability depends on version, settings, retention, access, and collection.

A conceptual evidence flowAn examination may begin anywhere in this sequence. Preserve the links and record the gaps.
  1. 01Human
  2. 02AI System
  3. 03Response / Tool Action
  4. 04Local / Cloud / Application Artifacts
  5. 05Transformation / Export
  6. 06Forensic Acquisition
Examine the evidence lifecycle
Published methodology / v0.1

A framework for a defensible examination.

The Synthetic Forensics Investigation Framework organizes ten stages from identification to reporting. It makes validation and uncertainty visible throughout the work.

Explore SFIF

Published by SyntheticForensics.org. Project-authored methodology with explicit scope and limits.

  1. 01Identify
  2. 02Preserve
  3. 03Acquire
  4. 04Extract
  5. 05Reconstruct
  6. 06Correlate
  7. 07Attribute
  8. 08Validate
  9. 09Interpret
  10. 10Report
Reference library

Build a traceable conclusion.

Search the reference
Open technical work

Tools and projects.

Explore the investigation framework, report specification, and reference downloads. The tool catalog describes software by purpose, evidence types, and validation conditions. Use the source archive and GitHub gateway for technical inspection.

View current projects

Tools and resources · GitHub

Build the field together

Learn, question, contribute.

Use the reference now and contribute a clear question, reproducible method, or useful explanation.

About the project and its responsibility