Web-forensics use case
Acquire web-based AI assistant and chatbot evidence
Eviquire can preserve an authorized web-based AI or chatbot exchange together with the service and account context shown by the interface, model or mode label, prompts, responses, citations, attached files, conversation history, settings and available exports. It records a particular displayed exchange; it does not reveal hidden prompts, model weights, training data or guarantee that the same input will reproduce the same output.
What this use case means
Eviquire can preserve an authorized web-based AI or chatbot exchange together with the service and account context shown by the interface, model or mode label, prompts, responses, citations, attached files, conversation history, settings and available exports. It records a particular displayed exchange; it does not reveal hidden prompts, model weights, training data or guarantee that the same input will reproduce the same output.
Generative systems are non-deterministic, continuously updated and often personalize behaviour through account history, tools, location or model routing. Responses can stream, regenerate, cite changing sources or be edited by the user. Evidence must preserve the exact conversation branch, visible model context, attachments and acquisition time without treating generated assertions as facts.
Common situations
When this workflow is useful
- Workplace, consumer, educational, safety, IP, contractual or regulatory review of an AI exchange
- Preserving a response before history, citations, model routing or service behaviour changes
- Documenting an authorized conversation for incident, quality, disclosure or expert analysis
Recommended process
A documented acquisition workflow
- Define the conversation scope
Identify service, account, conversation, relevant turns, attachments, settings, dates and sensitive exclusions.
- Record visible system context
Preserve account role, model or mode label, tools, locale, settings, conversation ID and navigation where shown.
- Acquire the exact branch
Record prompts and complete streamed responses, citations, warnings, edits, regenerations and branch relationships without creating unnecessary new outputs.
- Preserve supplied artifacts
Download authorized conversation exports, attachments and cited files where independently authorized.
- Qualify reproducibility
Hash files, record acquisition time and service state, and treat later reruns as separate evidence rather than replacements.
Technical guidance
Conditions that affect AI-conversation acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Non-determinism and change
The same prompt can produce a different output because of sampling, model updates, context, tools or routing.
- Preserve the actual displayed exchange.
- Record visible model context.
- Do not claim universal repeatability.
Conversation branches and edits
Regeneration, editing and branching can hide earlier outputs or create parallel histories.
- Identify the selected branch.
- Capture edit indicators.
- Preserve exports without flattening relationships where possible.
Citations and confidential data
Citations can change and prompts or files may contain secrets, personal data and third-party works.
- Acquire cited sources separately.
- Minimize confidential content.
- Protect and redact review copies.
Reviewable output
What the evidence package should explain
Service context
Service, role, visible model or mode, settings, conversation and acquisition time.
Conversation record
Prompts, responses, branches, warnings, citations and continuous session video.
Files and exports
Authorized attachments, conversation exports and separately preserved cited sources with hashes.
Review package
Non-determinism limitations, timestamps, activity and custody records.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Generated content may be inaccurate, harmful or derivative; preservation does not validate its truth or originality.
- Do not enter confidential or personal data merely to reproduce a finding.
- Distinguish the user’s prompt, the service’s displayed response and external cited sources.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can the same AI answer be reproduced later?
Not reliably. Preserve the actual exchange and record visible context.
Does Eviquire reveal the system prompt?
No. It records what the authorized interface exposes.
Should cited webpages be acquired?
Yes when relevant and authorized, as separate sources.
Can edited or regenerated answers be captured?
Yes when the interface still exposes them; record branches and edit indicators.
Does an AI response prove the facts it states?
No. Claims require independent verification.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →