AI artifact forensics glossary

Which questions belong in this field?

An artifact is useful when it can be connected to a specific question. A database row might show that an application stored a message, while a download record might show that a file reached a device. Neither observation alone identifies the person who wrote the message or proves what a cloud service processed.

Separate the acquired original from working copies and analyst exports. Record application version, collection scope, account context, and the time basis of each source. An export is a product of an interface and its settings; it should not be assumed to contain every record held by the service.

Evidence sources and examination context

Start with an inventory of the sources you can lawfully acquire: application storage, filesystem objects, browser storage, service exports, and related system records. Preserve their relationships before opening them in tools that can modify state.

For SQLite storage, examine whether the acquired set includes the main database and relevant WAL state. SQLite documents that committed changes can reside in the WAL before a checkpoint transfers them to the main file. That behavior is a reason to assess the collected file set, not a promise that deleted conversations can be recovered. SQLite: Write-Ahead Logging.

Correlate identifiers and content before relying on timestamps. A local copy, synchronized copy, and export may all describe one event. Explain that dependency rather than presenting three copies as three independent confirmations.

A worked evidence example

Hypothetical example: an examiner receives a chat export and a folder of attachments. One exported message references an attachment identifier, but the folder contains only a similarly named file. The examiner records the reference and compares available identifiers and bytes; the filename alone does not close the relationship.

A useful result states which message and file were acquired, why they may be associated, and which service-side records were unavailable. It keeps the unresolved link visible instead of filling the gap with a plausible story.

What this evidence can and cannot establish

Artifacts can support observations about stored content, file relationships, and recorded activity within the acquired scope. A matching digest supports a byte comparison. It does not show who created a file, whether the content is true, or whether the collection is complete.

An absent cache entry can reflect eviction, synchronization, collection timing, or application design. Test those explanations before inferring deletion or concealment. Recovery and interpretation both need validation against the relevant application and version.

Essential terminology

• AI artifact — A record or residual object created, used, or retained by an AI application or its surrounding environment.
• Acquisition — Documented collection of evidence by an appropriate method, with scope, conditions, integrity checks, and limitations recorded.
• Preservation — Documented measures to reduce evidence alteration or loss, while recording unavoidable effects and handling.
• Chain of custody — A documented record of evidence handling, transfers, storage, and responsible parties over time.
• SQLite WAL — SQLite’s write-ahead log, which can hold committed database changes before checkpointing. Its forensic significance depends on acquisition consistency and application use.
• Browser storage — Data retained by a browser through mechanisms such as local storage, databases, or caches.
• Derived evidence — An output created from source evidence by a documented transformation, retained with a traceable relationship to its inputs.
• Collection scope — The stated boundaries of an evidence collection.

All 65 terms in this evidence field

• Acquisition
• Acquisition log
• AI anti-forensics
• AI artifact
• AI evidence
• Artifact
• Audit trail
• Bitstream image
• Browser history
• Browser storage
• Cache
• Chain of custody
• Cloud export
• Collection scope
• Confidence statement
• Cookie
• Data minimization
• Database checkpoint
• Database journal
• Deduplication
• Deleted record
• Derived evidence
• Digital evidence
• Disk image
• Evidence contamination
• Evidence identifier
• Evidence inventory
• File carving
• File container
• File signature
• Filesystem metadata
• Forensic artifact
• Forensic working copy
• Generative artifact
• Hash digest
• Hash verification
• IndexedDB
• Interpretation
• Live acquisition
• LocalStorage
• Logical acquisition
• Magic bytes
• Metadata
• Observation
• Persistence
• Preservation
• Read-only access
• Redaction
• Reproducibility
• Retention policy
• Session
• SessionStorage
• Slack space
• SQLite WAL
• Synchronization
• Synthetic artifact
• Synthetic evidence
• Synthetic forensics
• Timestamp
• Tombstone
• Transaction
• Unallocated space
• Validation
• Volatile evidence
• Write blocker

Continue with an examination reference

• acquisition
• preservation
• ai artifacts
• artifact reports

Citation and editorial context

This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.

Examples are hypothetical. See the editorial policy, methodology, and correction process.

Shelley, Jesse (ed.). “AI artifact forensics glossary.” Synthetic Forensics, 1.1.0-glossary-library-1, 2026-10-09. https://syntheticforensics.org/glossary/artifacts/ Accessed: add the date you consulted this page.

The complete vocabulary

Browse the full glossary of 300 terms or download the machine-readable vocabulary.

Field assignment is the project’s organizational taxonomy; related evidence can span several fields.