How to use these scenarios
Read each scenario as an examination design exercise. Identify which records directly support a proposition and which steps require inference. The reporting examples use the confidence vocabulary without assigning invented percentages.
For collection and persistence context, consult the evidence taxonomy, methods, and the adjacent Anti-Forensics.com resource. None of these scenarios asserts a universal recovery or attribution capability.
Reconstructing an AI conversation timeline
Scenario
Hypothetical: an examiner receives an authorized conversation export and a document containing similar text. The export shows one selected response, and the document has a later modification time.
Questions
Was the text copied from this exchange? Were alternate responses or uploaded context available? What can be established about the sequence?
Evidence
The acquired export, raw message identifiers and timestamps, referenced attachments, document bytes, and independently acquired editing or download records, if available.
Method
Preserve each object. Map message relationships before writing a transcript. Verify timestamp meaning and retain raw values. Compare text passages, attachment digests, and documented edits. Record branches the export does not include.
Potential findings
A matching passage and reliable event relationships may support that the document incorporates a recorded response. If branch information is unavailable, the source of the selected wording may remain unresolved.
Alternative explanations
The text could have been copied from another exchange, shared by another person, or independently written. A document modification time can describe later formatting rather than initial creation.
Limitations
An export may omit deleted messages, prior revisions, and context. A textual match does not establish motive or the identity of the person operating the account.
Reporting example
Observed: the acquired export and document contain the specified passage. Inferred: the documented sequence is consistent with copying the response into the document. Unresolved: the full interaction context and user intent.
Related field: Interaction Forensics. Consult evidence and methods before applying a scenario.
Examining provenance of an AI-assisted image
Scenario
Hypothetical: a circulated JPEG is alleged to be entirely camera-origin. An authorized sender copy includes a provenance manifest; the circulated derivative has none.
Questions
Are these versions related? What does the manifest assert? Which transformations could account for their differences?
Evidence
Both acquired files, container and metadata records, the manifest, referenced source assets when available, and export or sharing records.
Method
Hash identical-byte references and compare derivatives separately. Validate the manifest using recorded software and trust settings. Examine the signed assertion and check the relationship to the acquired image. Compare transformation history with independent project records.
Potential findings
A validated assertion may document a stated AI-assisted editing step in the sender copy. It may support a relationship to the circulated derivative when independent comparison and workflow records align.
Alternative explanations
The derivative could have been produced separately, the assertion could cover only part of the workflow, or an untrusted signer could have asserted a misleading history.
Limitations
A valid signature does not prove every factual claim. The missing manifest in the derivative does not prove either camera origin or AI generation.
Reporting example
Observed: the sender copy contains the specified manifest and the circulated copy does not. Validation result: the stated assertion validates under the recorded policy. Corroborated or unresolved: the relationship between the two files, depending on independent evidence.
Related field: Provenance Forensics. Consult evidence and methods before applying a scenario.
Correlating an agent tool call with filesystem changes
Scenario
Hypothetical: an agent transcript says a file was written. Acquired tool records show a write request and a reported success, while an independently acquired filesystem contains a file with matching bytes.
Questions
Was the request executed? Which task and permission context produced it? Was the final object later changed?
Evidence
Task and tool identifiers, request arguments, tool results, process and authentication logs where available, filesystem records, and byte digests.
Method
Distinguish requested action from reported completion. Correlate identifiers, time intervals, file location, and content. Preserve the delegation chain if a sub-agent made the call. Compare independent system records with the claimed effect.
Potential findings
A source-referenced chain can support a confirmed external effect under the recorded account context. A later file modification may require a separate event node.
Alternative explanations
Another process may have created identical bytes, the tool may have retried, or a synchronized source may have restored the file after the call.
Limitations
Tool logs may be incomplete, and an account credential does not establish a particular human operator. Missing system logs reduce independence.
Reporting example
Observed: the tool requested a write, and the acquired filesystem contains the referenced bytes. Corroborated: the execution relationship when independent logs support it. Unresolved: human control if no independent identity evidence was acquired.
Related field: AI Agent Forensics. Consult evidence and methods before applying a scenario.
Detection confidence versus provenance evidence
Scenario
Hypothetical: a detector labels a compressed image as synthetic. A signed record on a different copy describes camera capture but includes no complete editing history.
Questions
What exactly was tested? Does the signed record bind to the tested object? Are the findings contradictory or about different propositions?
Evidence
The tested file, available original, detector version and settings, validation conditions, provenance record, and documented transformations.
Method
Identify the exact byte object used by each method. Record detector domain and error limits. Validate the provenance binding and claim. Compare the images’ derivation using independent records instead of averaging method outputs.
Potential findings
The detector result can describe a classification under test conditions. A signed capture assertion can document an earlier step while leaving later modifications unresolved.
Alternative explanations
Compression may affect classification; the signed record may cover a different object; a camera-origin image may have undergone AI-assisted editing after capture.
Limitations
A detector percentage is not automatically a case-specific probability. A signature does not establish a complete or truthful editing history.
Reporting example
Observed: the detector produced the recorded classification for the tested derivative. Observed: the other copy contains a signed capture assertion. Unresolved: the derivative’s full workflow unless source relationships and later steps are corroborated.
Related field: Synthetic Media Forensics. Consult evidence and methods before applying a scenario.
Examining a synthetic identity account cluster
Scenario
Hypothetical: several public accounts use similar generated-looking avatars and publish the same messages within minutes. An authorized account export is available for only one account.
Questions
Are assets identical or merely similar? Is there evidence of coordination? Can any shared operator be identified?
Evidence
Dated public captures, original accessible assets, posting records, cross-platform links, and the authorized export’s identifiers and access records.
Method
Separate persona, account, asset, and operator nodes. Compare exact files using digests and label perceptual comparisons. Examine timing against shared scheduling or content syndication alternatives. Limit collection of unrelated personal data.
Potential findings
Identical assets and source-referenced publishing patterns may support reuse or a coordination hypothesis. Operator attribution may remain unresolved even if an avatar is shown to be synthetic.
Alternative explanations
Accounts could copy each other, use a common stock asset, subscribe to the same feed, or share a legitimate scheduling service.
Limitations
Public captures are incomplete and mutable. A generated face does not prove fraud or common control. One export cannot establish the private history of every account.
Reporting example
Observed: the stated accounts reused the acquired asset and messages. Inferred: the timing is consistent with coordination under the tested comparison. Unresolved: shared human control and the intent behind the accounts.
Related field: Synthetic Identity Forensics. Consult evidence and methods before applying a scenario.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- NIST AI 100-4: Reducing Risks Posed by Synthetic Content
2024 overview of detection, watermarking, and content provenance approaches. Method performance requires context-specific evaluation.
- C2PA Specifications 2.4
Content Credentials technical specification and supporting documents. Claims and identity trust need separate evaluation.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
Canonical reference: https://syntheticforensics.org/case-studies/
Report a technical correction