Interaction / conversation evidence
A transcript, application export, or acquired conversation store may represent only one view of an interaction.
| Consideration | Examination context |
|---|---|
| Examples | Prompts, responses, branches, regeneration records, uploads, and tool-result messages. |
| Persistence | Edits, account deletion, retention settings, and export selection may omit earlier turns or branches. |
| Corroboration | Compare message identifiers, attachments, browser records, and independently acquired service records. |
| Interpretive caution | A saved prompt does not show all context presented to the model or establish a person’s intent. |
| Related field | Interaction Forensics |
Device / browser evidence
A device or browser profile can connect use of an interface with local activity.
| Consideration | Examination context |
|---|---|
| Examples | History, caches, IndexedDB, LocalStorage, SessionStorage, downloaded files, and operating-system traces. |
| Persistence | Private sessions, eviction, profile changes, synchronization, and clearing can affect availability. |
| Corroboration | Compare browser navigation with network observations, local downloads, and account-side events. |
| Interpretive caution | A visit to a service is not evidence that a particular output was generated or viewed. |
| Related field | AI Artifact Forensics |
AI application evidence
Application state may expose relationships unavailable in a screenshot or rendered transcript.
| Consideration | Examination context |
|---|---|
| Examples | SQLite databases, JSON records, logs, session files, configuration, model selections, and attachments. |
| Persistence | Schema migrations, caching, deletion, and synchronization can change records between versions. |
| Corroboration | Use controlled tests with the same version; compare exports, application state, and external effects. |
| Interpretive caution | A field name is not a verified meaning. No application-specific artifact locations are asserted here. |
| Related field | AI Artifact Forensics |
Agent / action evidence
An agent can affect systems beyond its own conversation interface.
| Consideration | Examination context |
|---|---|
| Examples | Task records, tool calls, delegated-agent identifiers, shell output, API responses, and filesystem changes. |
| Persistence | Tool logs and external system retention often differ; transient state may disappear at task termination. |
| Corroboration | Correlate tool identifiers with file hashes, system logs, API audit events, and network evidence. |
| Interpretive caution | A proposed action is not an executed action; a tool result is not always proof of the final external state. |
| Related field | AI Agent Forensics |
Synthetic-media evidence
Content may be generated, AI-assisted, edited, composited, or captured from another surface.
| Consideration | Examination context |
|---|---|
| Examples | Images, audio, video, generated text, codec data, embedded metadata, and derivative files. |
| Persistence | Transcoding, cropping, screenshotting, recompression, and sharing can remove signals and metadata. |
| Corroboration | Seek original files, project records, source assets, authenticated provenance, and creation-side records. |
| Interpretive caution | Detector scores do not establish provenance. Artifacts can also arise from ordinary editing or compression. |
| Related field | Synthetic Media Forensics |
Provenance evidence
A provenance record describes selected relationships or claims about content and workflow.
| Consideration | Examination context |
|---|---|
| Examples | Manifests, signed assertions, Content Credentials, certificates, transformation records, and watermarks. |
| Persistence | Records may be embedded, external, incomplete, stripped, or unavailable to an examiner. |
| Corroboration | Validate bindings and signatures; compare signer trust, referenced ingredients, and independent records. |
| Interpretive caution | A valid signature supports a signed claim’s integrity within its trust model, not the truth of every claim. |
| Related field | Provenance Forensics |
Network evidence
Traffic can support timing and endpoints of interactions or agent actions.
| Consideration | Examination context |
|---|---|
| Examples | DNS, proxy, firewall, packet captures, request metadata, and service connection logs. |
| Persistence | Encrypted payloads, log rotation, shared infrastructure, and collection gaps limit visibility. |
| Corroboration | Compare request identifiers, endpoint logs, device activity, and application event times. |
| Interpretive caution | A connection rarely proves content, user identity, or completion without additional records. |
| Related field | AI Agent Forensics |
Account / cloud evidence
Remote state may differ from the local device and may cover multiple users or devices.
| Consideration | Examination context |
|---|---|
| Examples | Authorized exports, access logs, sessions, workspace audit events, stored attachments, and sharing records. |
| Persistence | Provider retention, account state, tenancy, region, and export scope affect completeness. |
| Corroboration | Connect account events to acquired devices, independently captured identifiers, and access histories. |
| Interpretive caution | An account association does not establish which human controlled a session at a particular time. |
| Related field | Synthetic Identity Forensics |
Model / configuration evidence
A deployment can combine a base model, adapters, retrieval, policies, and tools.
| Consideration | Examination context |
|---|---|
| Examples | Model identifiers, deployment settings, version records, lineage, fine-tuning records, and legitimately acquired weights. |
| Persistence | Providers can change aliases; historical settings and unavailable weights constrain reconstruction. |
| Corroboration | Compare deployment records, model file digests, registry data, and documented change histories. |
| Interpretive caution | A model label is a claim about a deployment. Output style is insufficient for certain model identification. |
| Related field | Model Forensics |
Build an evidence inventory
Assign source identifiers before correlation. Record collection scope, location, access method, version, account context, timezone, and digests where applicable. Distinguish a missing record from an unexamined source. Retain source relationships so that copies of one event are not counted as independent corroboration.
Continue with the evidence lifecycle, examination methods, and Artifact Report format. Anti-Forensics.com provides adjacent material on digital evidence and anti-forensic indicators; destructive behavior must be supported by records, not inferred merely from missing data.
Machine-readable reference: evidence-taxonomy.json · Release SHA-256 hashes
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- NIST AI 100-4: Reducing Risks Posed by Synthetic Content
2024 overview of detection, watermarking, and content provenance approaches. Method performance requires context-specific evaluation.
- SQLite: Write-Ahead Logging
Database, WAL, checkpoint, and associated shared-memory behavior. General SQLite behavior is not proof of an AI application’s storage design.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
Canonical reference: https://syntheticforensics.org/evidence/
Report a technical correction