{
  "schema_version": "1.0",
  "id": "sfif",
  "name": "Synthetic Forensics Investigation Framework",
  "abbreviation": "SFIF",
  "version": "0.1",
  "status": "Proposed Methodology",
  "draft": "Draft 0.1",
  "published": "2026-10-01",
  "updated": "2026-10-01",
  "last_reviewed": null,
  "url": "https://syntheticforensics.org/framework/",
  "license": "CC-BY-4.0",
  "stages": [
    {
      "id": "identify",
      "number": "01",
      "name": "Identify",
      "objective": "Bound the investigative question and identify potentially relevant systems, evidence, and authority.",
      "inputs": "The question, authorization, known objects, accounts, devices, platforms, and initial incident information.",
      "actions": "Define propositions that can be tested. Inventory media, applications, interactions, agents, accounts, model configuration, and provenance. Record versions and access constraints. Prioritize volatile sources without assuming they exist.",
      "outputs": "A scoped question, source inventory, collection priorities, and explicit exclusions.",
      "failure_modes": "Starting with a detector and treating its result as the entire investigation; collecting without a defined scope; overlooking cloud or external system evidence.",
      "validation": "Check that each proposed source has a relationship to the question and that the planned collection is authorized. Record uncertainty in the initial inventory.",
      "method": "scoping",
      "url": "https://syntheticforensics.org/framework/#identify",
      "method_url": "/methods/#scoping"
    },
    {
      "id": "preserve",
      "number": "02",
      "name": "Preserve",
      "objective": "Reduce avoidable alteration or loss and document handling of the identified sources.",
      "inputs": "The inventory, volatility assessment, access permissions, source state, and available collection controls.",
      "actions": "Record current state and timing. Protect original objects. Decide whether live collection is necessary and document its effects. Preserve related files and remote records where authorized. Avoid launching applications merely to inspect them.",
      "outputs": "Preservation records, source identifiers, custody documentation, and a record of unavoidable changes.",
      "failure_modes": "Allowing synchronization to alter evidence; assuming a screenshot preserves the full source; losing transient task or browser state while waiting.",
      "validation": "Check handling records and the scope preserved. A byte digest supports later comparison; it does not prove that the source was truthful or complete.",
      "method": "preservation",
      "url": "https://syntheticforensics.org/framework/#preserve",
      "method_url": "/methods/#preservation"
    },
    {
      "id": "acquire",
      "number": "03",
      "name": "Acquire",
      "objective": "Collect evidence in a documented manner that permits examination and integrity checks.",
      "inputs": "Preserved sources, collection plan, tools, access conditions, and known technical constraints.",
      "actions": "Use an appropriate image, logical collection, export, or authorized service request. Capture related records and acquisition metadata. Hash collected objects where applicable. Record tool versions, filters, collection time, and failures.",
      "outputs": "Acquired objects, digests, collection logs, scope description, and unavailable-source records.",
      "failure_modes": "Copying an inconsistent live database; presenting an export as a complete device image; omitting collection filters and failed sources.",
      "validation": "Verify acquired file accessibility, expected scope, digests, and collection logs. Explain differences between acquisition types and their limits.",
      "method": "acquisition",
      "url": "https://syntheticforensics.org/framework/#acquire",
      "method_url": "/methods/#acquisition"
    },
    {
      "id": "extract",
      "number": "04",
      "name": "Extract",
      "objective": "Expose relevant records while preserving their connection to the acquired source.",
      "inputs": "Working copies, schemas, file format documentation, parser versions, and source identifiers.",
      "actions": "Parse records and inspect raw data. Retain message and task identifiers, parent-child relations, attachment references, original timestamps, and unsupported fields. Store derived output separately from acquired evidence.",
      "outputs": "Source-referenced records, parser logs, normalized views, and a list of unsupported or ambiguous values.",
      "failure_modes": "Discarding fields because a parser does not recognize them; silently converting time units; flattening a branch graph into a misleading transcript.",
      "validation": "Compare samples with raw records and an independent method. Use known-answer fixtures where available, and document parser coverage.",
      "method": "extraction",
      "url": "https://syntheticforensics.org/framework/#extract",
      "method_url": "/methods/#extraction"
    },
    {
      "id": "reconstruct",
      "number": "05",
      "name": "Reconstruct",
      "objective": "Build the sequence and relationships needed to explain the investigated activity.",
      "inputs": "Extracted events, identifiers, timestamps, branches, tool calls, and transformation records.",
      "actions": "Construct timelines and event graphs. Preserve alternate branches and revisions. Distinguish creation, receipt, synchronization, export, and acquisition times. Express intervals when clock relationships are uncertain.",
      "outputs": "A source-referenced timeline or graph with explicit gaps and competing orderings where necessary.",
      "failure_modes": "Ordering by display time alone; treating a generated plan as an executed action; filling missing interaction context with plausible text.",
      "validation": "Check every graph edge against its supporting records. Record clock offsets, time resolution, and uncertainty rather than inventing a precise sequence.",
      "method": "timeline-reconstruction",
      "url": "https://syntheticforensics.org/framework/#reconstruct",
      "method_url": "/methods/#timeline-reconstruction"
    },
    {
      "id": "correlate",
      "number": "06",
      "name": "Correlate",
      "objective": "Compare sources and test whether their relationships support or conflict with the propositions.",
      "inputs": "The reconstruction, independent evidence, file digests, account events, network logs, and external system records.",
      "actions": "Match reliable identifiers and byte digests. Compare timing with stated tolerances. Identify shared upstream sources. Seek contradictory records and test alternative explanations for apparent matches.",
      "outputs": "A correlation matrix showing support, conflicts, source dependence, and unresolved links.",
      "failure_modes": "Counting replicated copies as independent corroboration; relying only on approximate time; suppressing evidence that conflicts with the preferred hypothesis.",
      "validation": "Check whether the sources are independent for the particular claim. A shared backend or parser may produce correlated errors.",
      "method": "correlation",
      "url": "https://syntheticforensics.org/framework/#correlate",
      "method_url": "/methods/#correlation"
    },
    {
      "id": "attribute",
      "number": "07",
      "name": "Attribute",
      "objective": "Evaluate any supported association with a source, system, workflow, account, model, or actor.",
      "inputs": "Correlated records, provenance assertions, configuration, authentication context, and alternative source hypotheses.",
      "actions": "Name the attribution level. Separate represented identity, account, access mechanism, and human control. Test alias changes, shared accounts, copied content, and delegated actions. Preserve unresolved attribution when support is insufficient.",
      "outputs": "A bounded attribution statement, its evidence basis, and explicit alternatives.",
      "failure_modes": "Naming a model from output style; equating a credential with a person; treating a signed assertion as proof of every origin claim.",
      "validation": "Review whether the claimed level is stronger than the evidence permits. Independent corroboration should address the actual attribution proposition.",
      "method": "attribution",
      "url": "https://syntheticforensics.org/framework/#attribute",
      "method_url": "/methods/#attribution"
    },
    {
      "id": "validate",
      "number": "08",
      "name": "Validate",
      "objective": "Test the methods and artifact interpretations used in the examination.",
      "inputs": "Tools, versions, configurations, fixtures, controlled observations, relevant source documents, and reproducible procedures.",
      "actions": "Check parser results and timestamp interpretation. Replicate material observations under stated conditions. Test controls and edge cases. Document detector domain and error limits. Record external specifications and trust settings.",
      "outputs": "A validation record, repeatable procedures, observed limits, and an updated confidence assessment.",
      "failure_modes": "Calling a single successful observation “validated”; applying a benchmark outside its tested population; changing a tool version without recording it.",
      "validation": "Define what was tested and what was not. Review by another examiner is useful but does not replace an adequate experiment or scope statement.",
      "method": "validation",
      "url": "https://syntheticforensics.org/framework/#validate",
      "method_url": "/methods/#validation"
    },
    {
      "id": "interpret",
      "number": "09",
      "name": "Interpret",
      "objective": "Assess what the validated evidence supports about the original question.",
      "inputs": "Observed records, correlations, attribution limits, validation results, conflicts, and unavailable sources.",
      "actions": "Separate observation from interpretation and inference. Evaluate alternatives and contradictions. State material assumptions. Explain what would be needed to resolve remaining questions. Avoid translating project confidence labels into percentages.",
      "outputs": "Reasoned findings with confidence vocabulary, alternatives, and limitations tied to each proposition.",
      "failure_modes": "Inferring intent from a prompt alone; treating missing provenance as proof of non-synthetic origin; conflating detector output with a forensic conclusion.",
      "validation": "Check that conclusions can be traced to evidence and survive quotation with their essential caveats. Ask whether contrary evidence changes the conclusion.",
      "method": "interpretation",
      "url": "https://syntheticforensics.org/framework/#interpret",
      "method_url": "/methods/#interpretation"
    },
    {
      "id": "report",
      "number": "10",
      "name": "Report",
      "objective": "Communicate the examination so another reader can assess its basis, scope, and limits.",
      "inputs": "Findings, source inventory, custody records, methods, versions, validation results, and supporting artifacts.",
      "actions": "Report direct observations, interpretations, attribution, and confidence separately. Include unavailable sources, alternative explanations, and reproducibility details. Redact sensitive information proportionately. Version the report and preserve material revisions.",
      "outputs": "A dated report, Artifact Reports where appropriate, supporting references, digests, and a recoverable version history.",
      "failure_modes": "Publishing unsupported certainty; omitting inconvenient gaps; disclosing secrets; silently replacing a materially important conclusion.",
      "validation": "Review evidence-to-claim traceability, reproducibility, citation accuracy, and redactions. Confirm that uncertainty remains visible in the final presentation.",
      "method": "reporting",
      "url": "https://syntheticforensics.org/framework/#report",
      "method_url": "/methods/#reporting"
    }
  ]
}