AI Forensics Process Model Proposes an 'Order of Volatility' Starting With Runtime State and Context Windows

arXiv 2608.03520·low signalXBlueskyLinkedInCopy link

Arguing that investigator access level is the right organizing axis for a fragmented field, the paper distinguishes white-, grey-, and black-box access and shows how each changes what can be collected, preserved, analyzed, and reported across four phases. Its most operationally useful contribution is an order of volatility for AI systems — runtime state, context windows, logs, retrieval stores, model artifacts, training lineage — which maps directly onto what an agent operator should be capturing before it evaporates. Open problems named include black-box preservation, model version attestation, and chain of custody for mutable AI artifacts.