Interaction Forensics

Scope

The unit of examination is the interaction and its relationships. It can include prompts, system or application context when available, retrieval material, attachments, model labels, selected branches, edits, and responses. Separate content presented to a model from content merely stored in the same account. A rendered transcript can flatten relationships that existed in the source.

Why the field matters

A quoted prompt may omit an earlier correction, uploaded instructions, or a regenerated response. The final document may combine several responses with manual edits. Reconstructing these transitions can explain a workflow without claiming access to the person’s beliefs, motive, or complete mental state.

Evidence sources

• Acquired conversation records, authorized exports, message identifiers, branches, revisions, and regeneration relationships.
• Uploads, attachment hashes, retrieval references, available context, model selection, and application settings.
• Tool-call messages and results, timestamps, browser activity, generated files, and downstream user edits.

Typical investigative questions

• Which response belongs to which input, and were alternate responses retained?
• What context was demonstrably available at the relevant turn?
• Was a revision made by a person, an application, or a further model response?
• Can a later file be connected to a specific response rather than just similar wording?
• Which intervals and branches are absent from the acquisition?

Examination methods

Preserve source structure before constructing a readable transcript. Map message identifiers, parent-child relationships, attachment references, and source timestamps. Build an event graph where branches exist rather than forcing every record into a single sequence. Record the difference between a server event time and a local display or export time.

Use raw records to verify selected transcript passages. Compare revisions and identify which representation an interface or export chose. Associate tool activity by identifiers when possible; approximate temporal proximity is weaker evidence. Re-run a prompt only as a controlled experiment: nondeterminism, changed context, model updates, and unavailable settings limit comparison with a historical exchange.

Corroborating evidence

Match attachments and generated files by digest where identical bytes exist. Correlate independent download, editing, or execution records with the conversation event graph. Distinguish a participant’s recollection from recorded activity. Synthetic Imprinting concerns memory and interpretation of synthetic information, an adjacent cognitive subject rather than an interchangeable forensic method.

Common failure modes

• Treating the currently selected branch as the only response ever produced.
• Assuming an export includes hidden context, deleted records, or every tool call.
• Reading a generated statement about an action as evidence that the action occurred.
• Inferring intent solely from an instruction copied into a conversation.

Limitations

Providers may withhold internal state and context; applications can trim or summarize prior turns. An acquired prompt history may be incomplete. User-controlled text can include quoted material or adversarial instructions. Similar outputs may come from different systems, and an experimental replay cannot recover an inaccessible historical state.

Reporting cautions

Publish a source-referenced timeline with explicit gaps. Label direct message content as observed, event relationships as corroborated or inferred as appropriate, and intent as unresolved unless separate evidence supports it. Identify the level of completeness supported by the collection instead of calling the transcript “the complete interaction” by default.

How do you read a branching conversation?

Keep the source message identifiers, parent relationships, revisions, and attachments. Arrange the recovered records into a graph, and identify the branch represented by the displayed transcript. Distinguish a later alternative answer from an answer that was actually followed in the interaction.

The final account explains what is recorded and what context is unavailable. A user prompt may omit system instructions or retrieved material, so it does not automatically explain why every response or downstream action occurred.

Related fields & glossary terms

• AI Artifact Forensics
• AI Agent Forensics
• Provenance Forensics

Apply the examination methods, inspect the evidence classes, and check relevant external standards and specifications.