AI Forensic Investigation Reference Matrix

AFIRM

An openly licensed knowledge base for post-incident forensic investigation of AI systems. Rows are AFIRM's seven AI evidence classes, ordered by asserted volatility (EC01 most volatile → EC07 most stable). Columns are the five forensic phases.

A technique renders in a cell only if it directly consumes or produces that evidence class in that phase; cross-cutting techniques render as a phase band below the grid instead of being duplicated into every row.

Evidence class	P01 Identification	P02 Collection	P03 Examination	P04 Analysis	P05 Reporting
EC01 Live model & session state	T0104 Proposed T0104.001 Proposed T0105 Proposed	T0202 Demonstrated T0208.001 Proposed	T0301 Demonstrated T0302 Demonstrated	T0401 Demonstrated T0402 Demonstrated T0402.003 Demonstrated T0405 Proposed	—
EC02 Runtime telemetry & interaction logs	T0104 Proposed T0104.001 Proposed	T0203 Established T0206 Proposed T0208.001 Proposed	T0302 Demonstrated T0302.001 Proposed	T0402 Demonstrated T0402.004 Demonstrated T0402.005 Demonstrated T0404 Proposed	—
EC03 Retrieval & memory stores	T0104 Proposed T0104.001 Proposed	T0204 Proposed T0208.001 Proposed	—	T0401 Demonstrated T0401.002 Demonstrated	—
EC04 Deployment configuration	T0104 Proposed T0104.001 Proposed T0105 Proposed	T0205 Established	—	T0401 Demonstrated T0401.001 Demonstrated T0401.002 Demonstrated	—
EC05 Model artifacts at rest	T0104 Proposed T0104.001 Proposed	T0201 Established	T0303 Demonstrated	T0401 Demonstrated T0401.001 Demonstrated T0402 Demonstrated T0402.001 Established T0402.002 Demonstrated T0402.003 Demonstrated T0402.005 Demonstrated T0403 Demonstrated T0403.001 Proposed T0403.002 Demonstrated T0405 Proposed	—
EC06 Training & pipeline artifacts	T0104 Proposed T0104.001 Proposed	T0207 Established	—	T0403 Demonstrated T0403.001 Proposed T0403.002 Demonstrated	—
EC07 Documentation & static records	T0104 Proposed T0104.001 Proposed	—	—	—	—

Phase bands

Cross-cutting techniques

These techniques range over an entire phase rather than a single evidence class, and are rendered here instead of duplicated into every cell above.

P01 — Identification: T0101 Incident Characterization, T0102 Access Level Determination, T0103 System Composition Mapping
P02 — Collection: T0208 Chain of Custody for AI Artifacts
P04 — Analysis: T0406 Contributing-Factor Assessment, T0407 Incident Timeline & Narrative Reconstruction
P05 — Reporting: T0501 Structured Claim Formulation, T0502 Evidentiary Standard Assessment, T0503 Regulatory Reporting Alignment