AFIRM

P01

T0104 — Evidence Source Inventory

Proposed

Sub-techniques

  • T0104.001 — AI Artifact Volatility Ordering

Description

Evidence Source Inventory is the systematic enumeration, begun at engagement and iterated throughout, of what evidence exists for an AI incident, where it lives, who controls it, how long it will survive, and what does not exist. For each of AFIRM's seven evidence classes, the examiner records presence or absence, location and custodian, retention windows, and access constraints per component. It descends from the classical identification activity in NIST SP 800-86, but is harder in AI systems: evidence existence is not guaranteed by default, and evidence is distributed across components with different owners under different retention policies and legal postures.

Notes

safer-grade; classical ancestry Established

Metadata

Phase P01 — Identification
Evidence classes EC01 — Live model & session state, EC02 — Runtime telemetry & interaction logs, EC03 — Retrieval & memory stores, EC04 — Deployment configuration, EC05 — Model artifacts at rest, EC06 — Training & pipeline artifacts, EC07 — Documentation & static records
Access capability —
Capability/coverage only — not a claim-strength scale.
Status active

Claim & Validation Profile

Does establish

  • presence, absence, location, custodian, and retention window of evidence per class and component, as documented at inventory time

Does not establish

  • that a component reported as evidence-absent is genuinely nonexistent rather than merely not produced

Alternative propositions & corroboration

  • absence may reflect not_configured, expired, not_retained, inaccessible, not_produced, not_searched, or confirmed_nonexistent — these are distinct states, not synonyms

Quality controls

  • timestamp the inventory
  • initiate authorized preservation immediately through the engagement's legal/organizational process

Case-specific limitations & stop conditions

  • do not report provider non-production of evidence as confirmed nonexistence

Admissibility is not stated here — see the Evidentiary Standard Assessment (T0502) jurisdiction overlays.

Forensic Readiness Measures

ID Measure Relationship
R0009 AI System, Component & Custodian Register strengthening

References

  1. NIST SP 800-86 — Guide to Integrating Forensic Techniques into Incident Response (citation pending verification)
  2. RFC 3227 — Guidelines for Evidence Collection and Archiving (citation pending verification)
  3. ISO/IEC 27037 — identification, collection, acquisition and preservation of digital evidence (citation pending verification)
  4. EU AI Act logging/retention obligations (citation pending verification)

Case Applications

No published case applications yet.