Scope
Include AI-assisted modification as well as generation. A document may contain both human and machine contributions, while an agent can leave traces of actions across a filesystem, browser, or external service.
Questions worth testing
- What persisted after the interaction?
- Which record connects a generated file to a task?
- Was a claimed agent action attempted, completed, or independently observed?
Evidence and study material
Message identifiers, attachments, task and tool logs, local databases, filesystem objects, account exports, and service audit records are candidate sources. An available interface does not guarantee that its underlying history was retained.
Methods to begin with
Limits on interpretation
Application migrations, cache eviction, asynchronous writes, and restricted exports can change coverage. A finding from one build should not be generalized to another without validation.
Open research questions
Priorities include versioned artifact observations, parser coverage, and comparisons between local and exported state. Agent retries and delegated work also need records that distinguish intention from external effects.
Tools, projects, datasets, and publication
The existing AI Agent Forensics guide and Artifact Report templates support documentation today. New artifact findings belong in Journal technical notes only after a described experiment; no application-specific dataset is published here.
How do you turn an artifact into a reproducible observation?
Choose one application behavior and a documented environment. Preserve a baseline, perform the controlled action, collect the resulting sources consistently, and repeat with appropriate controls. Record failures and differences as carefully as successful observations.
Use an Artifact Report to connect raw records, schema interpretation, versions, and limitations. A result on one platform version is a bounded finding rather than a promise that the same record exists in every account or future release.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- SQLite: Write-Ahead Logging
Database, WAL, checkpoint, and associated shared-memory behavior. General SQLite behavior is not proof of an AI application’s storage design.
- Model Context Protocol: Tools, specification 2025-11-25
Tool descriptions, calls, and result semantics for the named protocol revision. A protocol definition does not guarantee persistent audit records.
Canonical reference: https://syntheticforensics.org/research/ai-artifacts/
Report a technical correction