Conversational AI forensics: A case study on ChatGPT, Gemini, Copilot, and Claude

Recent advances in conversational AI services have attracted interest from both specialized technical communities and the general public. Major IT companies such as OpenAI, Microsoft, and Google are actively developing and enhancing conversational AI technologies. The widespread public interest and usage of these services are rapidly increasing due to their interactive chat interfaces, which are easily accessible to anyone with basic digital literacy. However, with the growing utilization of these services, there is a risk that some users may exploit them for malicious purposes, such as technology leaks, phishing, and malware creation. This paper proposes a method for forensically investigating conversational AI services. It examines the characteristics of these services across various environments from the perspective of a digital forensic investigator and outlines a method for collecting forensic artifacts. Based on the analysis, we present a forensic investigation framework for conversational AI services, including case studies of representative services such as ChatGPT, Copilot, Gemini, and Claude.