- 01Human Input
- 02Context
- 03Model Response
- 04Revision / Regeneration
- 05Tool or Agent Action
- 06Downstream Artifact
Collect the exchange and its context
Record where the conversation came from: an export, acquired database, rendered view, or authorized service response. Note application and model labels, collection scope, and export options. Preserve uploaded objects separately with identifiers and digests. Identify which parts of context were available and which were inaccessible.
Do not assume all context was user supplied. System instructions, retrieved material, tool results, and application summaries may influence an answer. A source may prove that an attachment was stored without proving that its entire content reached the model at a particular turn.
Build an event map
| Event relationship | What to record | Caution |
|---|---|---|
| Input → context | Input ID, upload references, available settings | Stored material may not equal active model context. |
| Context → response | Response ID, parent ID, model label, source timestamp | Model labels may not identify historical deployment state. |
| Response → revision | Original and revised text, actor where recorded | A flattened export may display only the current revision. |
| Input → regeneration | Alternative response nodes and selection state | Unselected alternatives may be omitted. |
| Tool → downstream artifact | Call ID, result, output object, external corroboration | A generated statement that an action occurred is insufficient. |
Verify time and order
Retain each raw timestamp and determine its meaning before converting it. A message time, export generation time, file modification time, and browser visit time can describe different events. Use identifiers to establish relationships where clocks disagree. Show gaps rather than constructing a falsely precise sequence.
Connect downstream user actions
A response may be copied, edited, executed, shared, or ignored. Seek independently acquired document revisions, downloads, filesystem changes, or service records. A matching passage supports a content relationship, but can have alternative explanations. Define whether a conclusion concerns origin of wording, use of a workflow, or control of an account.
Historical reconstruction and replay
Re-running a prompt is an experiment in the current environment. Model updates, nondeterminism, changed context, and unavailable parameters can produce different outputs. Preserve the historical evidence and describe replay conditions. Do not substitute a new response for missing historical text.
Reconstruction does not establish intent
A person may paste quoted instructions, test a hypothesis, correct an earlier turn, or react to misleading information. Evidence can show a recorded action without explaining its motive. Intent requires separate support and should remain unresolved where it cannot be established.
Source monitoring and memory are adjacent cognitive questions addressed by Synthetic Imprinting. The field reference defines examination scope; the hypothetical conversation case illustrates reporting with alternatives.
Common questions
Can a deleted exchange leave traces? Possibly, depending on platform, version, storage, synchronization, retention, and acquisition. No recovery is guaranteed.
Is an export complete? Completeness must be assessed against its documented and observed scope. It may omit branches, deleted material, or inaccessible context.
Does input prove intent? It records supplied content under the source’s conditions. It does not automatically establish motive or understanding.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
- Model Context Protocol: Tools, specification 2025-11-25
Tool descriptions, calls, and result semantics for the named protocol revision. A protocol definition does not guarantee persistent audit records.
Canonical reference: https://syntheticforensics.org/interaction-forensics/
Report a technical correction