Methods for examining AI-related evidence

Evaluation and method guides

Scoping

Define the proposition, authorized systems, relevant period, and the decision the examination must support. Separate questions about a media object, a workflow, an account, and a human actor. Each may need different evidence. Record exclusions and unavailable sources at the start; they can constrain every later conclusion.

Identification

Inventory potential interaction records, application storage, browser state, media, agent actions, model configuration, provenance, network records, and cloud accounts. Record source version and platform. Do not assume a cache, database, or audit log exists because another product retains one. Prioritize volatile sources by the actual environment.

Preservation

Protect original objects and document handling. Live applications can write, migrate, synchronize, or delete state when opened. A live acquisition can be justified, but its consequences should be recorded. Capture source state, timestamps, tool versions, and custody details. A screenshot may preserve a display; it does not preserve underlying records or branch relationships.

Acquisition

Choose a documented collection method that fits the question and access conditions: physical image, logical collection, export, or authorized remote retrieval. These methods have different coverage. Record filters, failures, and the interval covered. Use SHA-256 for byte-integrity comparisons where applicable, with filenames and byte lengths. A digest does not establish the truth or origin of the content.

Examination

Work from copies. Identify formats, schemas, encoding, identifiers, and relationships before assigning meaning. For SQLite sources, assess journal mode and related files; an inconsistent live copy can distort the available records. Examine the raw material as well as tool output. Preserve unsupported records and document what the examination software could not interpret.

Extraction

Convert records into an inspectable representation without losing their source references. Keep original timestamps, message and task identifiers, parent relationships, null values, and attachment references. Store derived output separately. A parser should document coverage and errors. A human-readable transcript is a derived view, not an automatic replacement for the original record structure.

Timeline reconstruction

Determine which event each timestamp describes, its units, epoch, timezone, clock source, and resolution. Normalize only verified representations. Retain raw values and conversion rules. Use intervals or partial ordering when clocks cannot be reconciled. Branches, retries, and asynchronous agent completion may require a graph instead of a single ordered list.

Correlation

Compare identifiers, byte digests, content relationships, timestamps, and independent system effects. Describe the strength of each relationship and plausible alternatives. Distinguish independent records from replicas of one source. Two exports from the same backend may corroborate a parsing operation without independently corroborating the underlying event. Seek conflicts as well as supporting evidence.

Attribution

Name the level: object, application, workflow, model label, account, or person. Model-family attribution differs from identification of exact deployed weights. An account or credential does not by itself identify the human controlling it. Generated text about its own origin is not a reliable identity record. Preserve unresolved attribution when stronger evidence is unavailable.

Validation

Test consequential interpretations with raw-record comparison, controlled observations, appropriate fixtures, and independent methods. State environment, repetitions, controls, and tested limits. A detector needs evaluation conditions relevant to the examined object; a parser needs field and schema coverage. Repeatability under one setting does not establish validity in every version or platform.

Interpretation

Explain how evidence relates to the original proposition. Distinguish direct findings from inference, consider alternatives, and make assumptions explicit. Absence of a record can reflect non-creation, loss, exclusion, access restrictions, or unsupported parsing. Do not select one explanation without support. Intent and factual authenticity may remain unresolved after a reliable reconstruction.

Reporting

Report source scope, methods, versions, validation, findings, conflicts, and limitations. Keep conclusions traceable to their supporting records. Use the published SFIF to structure an examination and an Artifact Report to document tested storage behavior. Protect credentials and sensitive personal information in public material.

Related digital-forensics practice

Anti-Forensics.com is an adjacent resource on digital evidence, persistence, and anti-forensic considerations. Missing records alone are not evidence of deliberate destruction. Examine acquisition coverage, retention, and ordinary system behavior before interpreting a gap. See the evidence lifecycle for where records may change or disappear.