Episode 22:AI Chat Forensics: How to Find, Investigate, and Analyse Evidence from ChatGPT, Claude & Gemini

TLP - The Digital Forensics Podcast

Send us a text

Unlock the secrets behind digital forensic investigations into AI chat platforms like ChatGPT, Claude, and Google's Gemini in this insightful episode. Learn the precise methods for discovering, extracting, and interpreting digital evidence across Windows, Mac, and Linux environments, whether it's browser caches, memory forensics, network logs, or cloud-based data exports.

From identifying subtle signs of malicious AI usage and attempts to evade security controls, to piecing together forensic timelines, this podcast provides practical, hands-on guidance tailored for cybersecurity professionals, forensic analysts, and IT investigators. Tune in now and boost your expertise in this emerging field of AI-driven digital forensics.
You'll learn:
AI Chat Evidence Locations
Discover exactly where to find critical forensic evidence from ChatGPT, Claude, and Gemini across Windows, Mac, and Linux systems.

Extracting and Analyzing Chat Data
Learn practical techniques to extract, review, and interpret digital artifacts, including browser caches, local storage, memory dumps, and network logs.

Identifying AI Jailbreaking and Misuse
Understand how to spot attempts to bypass AI guardrails and recognize malicious prompts or suspicious activity within chat logs.

Cloud vs Local Forensic Challenges
Explore unique challenges associated with investigating cloud-based AI platforms versus local installations, and how to overcome them.

Building Effective Forensic Timelines
Master the art of assembling comprehensive forensic timelines by integrating timestamps, metadata, network traffic, and other key sources of digital evidence.

Links and references

https://help.openai.com/en/articles/7260999-how-do-i-export-my-chatgpt-history-and-data

https://pvieito.com/2024/07/chatgpt-unprotected-conversations

https://www.scribd.com/document/818273058/Conversational-AI-forensics#:~:text=of%20Gemini%20are%20stored%20in,based%20mobile%20app

https://ar5iv.labs.arxiv.org/html/2505.23938v1#:~:text=source%20for%20corroborating%20evidence,of%20the%20NationalSecureBank%20phishing%20email

aletheia.medium.com