Purpose and when to use it
Use acquisition when a relevant source has been identified and collection authority and scope are established. Prioritize sources whose retention or live state could change while the examination waits.
Evidence required
Identify the system, account, relevant period, formats, and dependencies. An AI application may store attachment bodies separately from conversation references; a logical export may omit hidden branches or tool state.
Principles and procedure
- Record the source condition, access method, account scope, application version, and collection time.
- Choose the least disruptive method that meets the authorized question; document unavoidable live changes.
- Capture the collection result, errors, filters, and supporting files. Check that referenced attachments are actually present.
- Create an inventory with identifiers, byte lengths, and SHA-256 digests for acquired objects; preserve an original set.
What to document
Keep acquisition logs, source descriptions, authorization boundaries, failed requests, and completeness checks. Record whether timestamps belong to the source or were created by the collection tool.
Failure modes
Opening an application can synchronize, migrate, or write records. Inconsistent live database copying can lose recent data. An export that appears readable may still exclude information essential to the question.
Limits on the conclusion
No acquisition method guarantees complete cloud history. Unavailable sources, retention gaps, access restrictions, and unsupported formats must remain explicit scope limitations.
Independent checks and corroboration
Compare counts, identifiers, and sample raw records across genuinely different sources where authorized. A second export from the same backend checks export consistency but may not independently confirm the event.
How to report the result
State the collection method and coverage before presenting findings. Identify missing attachments and excluded sources so a reader can assess whether the conclusion depends on unavailable material.
Related glossary terms
How do you document an application export?
Record the account scope, export options, collection time, application version, object count, errors, and integrity measurements. Preserve the received package and a separately identified working extraction. Note branches, attachments, or event types that the format omits.
A good collection note lets another reader distinguish acquired material from unexamined sources. Describe coverage explicitly rather than using the word complete without a tested basis.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- SQLite: Write-Ahead Logging
Database, WAL, checkpoint, and associated shared-memory behavior. General SQLite behavior is not proof of an AI application’s storage design.
Canonical reference: https://syntheticforensics.org/methods/acquisition/
Report a technical correction