TechFusion Data Labs · Frontier forensics

Forensics
for the
AI era.

TechFusion has examined digital evidence since 1988. Data Labs is its division for evidence that generative AI and blockchains created: cloned voices and faces, AI agents that acted without approval, disputed models and training data, automated decisions, and crypto that moved on-chain.

The frontier

Where the
evidence is new.

A voice can be cloned in minutes. An AI agent can take actions no person typed. A customer who passed every identity check may not exist. The questions courts, boards and regulators ask are the same as ever: what happened, and can you prove it?

01 / Synthetic media

A familiar voice or face can be fake.

Cloned voices approve wire transfers. Face-swapped executives join video calls. In 2024 an engineering firm's Hong Kong office paid out about US$25 million after a video call in which the other participants were deepfakes.

Deepfake forensics →
02 / AI systems

Your AI tools are now witnesses.

Agents send email, call APIs and move data on their own. When one is hijacked, the evidence is in prompts, retrieved documents and tool calls, and it often expires quickly.

AI forensics →
03 / Identity

Your customer may not exist.

A generated face, a synthetic ID and a fake camera feed can pass a selfie check. Fraud teams need to know how it got through, and whether it was one person or a ring.

Identity attacks →
04 / Decisions

The algorithm said no.

Models now screen candidates, price insurance and approve credit. When a decision is challenged, the question is why the system decided as it did, and whether it treats groups differently.

Decision forensics →
05 / Ledgers

Money that moves on-chain.

Stolen funds hop across wallets, mixers and bridges in minutes. The blockchain records every hop. Turning that record into a trace an exchange or a court will act on takes careful work.

On-chain forensics →
Practices

What the lab
examines.

Each practice deals with evidence that generative AI or blockchains created. We use AI tools where they help and never let a single detector's score stand in for an examiner's finding.

Synthetic Media Detection

Was this voice, video, image or document made or altered by a generative AI model? Examined for the traces generators leave, reported with stated confidence.

  • Voice-clone detection
  • Face-swap and lip-sync detection
  • AI image-generator identification
  • C2PA content credentials and AI watermarks
Explore synthetic media

AI Agent Forensics

When an AI agent, copilot or chatbot is hijacked or takes an action nobody approved, we reconstruct what it read, what it was told and what it did.

  • Prompt-injection investigations
  • Guardrail-bypass analysis
  • Agent run and tool-call reconstruction
  • Poisoned retrieval and compromised AI plugins
Explore AI agent forensics

Model & Training-Data Forensics

Technical evidence for disputes about AI models themselves: whose model it is, what it learned from, and which system produced a given output.

  • Model provenance and lineage
  • Training-data membership testing
  • Memorization testing
  • AI output source testing
Explore model forensics

Identity-Verification Attacks

Onboarding and liveness checks are now attacked with deepfaked selfies, injected camera feeds and AI-made ID documents. We establish how a synthetic identity got through.

  • Camera-injection and virtual-camera attacks
  • Liveness and face-match spoofing
  • AI-generated ID documents
  • Synthetic identity rings
Explore identity attacks

AI Decision Forensics

When an automated system denies a loan, rejects a candidate or flags a claim, someone has to explain why. We reconstruct the decision and test the system for bias.

  • Automated decision reconstruction
  • Bias and disparate-impact testing
  • Bias audits for automated hiring tools
  • Model card verification
Explore decision forensics

On-Chain Forensics

Following crypto across public blockchains: where stolen or disputed funds went, which addresses belong together, and how a smart-contract exploit worked.

  • Transaction tracing across chains and bridges
  • Linking addresses to exchanges and services
  • Smart-contract and DeFi exploit analysis
  • Tracing reports for exchanges and courts
Explore on-chain forensics
Readiness programs

Ready before
it happens.

Evidence is easiest to prove when it was kept on purpose. These programs set that up before anything goes wrong, and the retainer puts an examiner on call.

Deepfake response retainer

A named examiner on call, a verification protocol for payment and executive requests, and a playbook for when a synthetic version of your leadership appears.

AI agent traceability review

Whether your agents and copilots record prompts, retrieved content and tool calls well enough to reconstruct an incident, and how to fix it before you need it.

Content credentials program

Signing your own photos, video and statements with C2PA content credentials, so your genuine media can be told apart from fakes of it.

Bias audit program

Recurring independent bias testing of the automated tools you use to hire, lend or price, with the documentation regulators ask for.

Method

Preserve first.
Prove second.

New kinds of evidence, the same discipline. AI providers purge conversations, platforms re-encode uploads, and agent logs roll over, so preservation comes before anything else.

01

Preserve fast

Original media, agent logs and model snapshots secured in the first hours, with preservation requests to AI providers and platforms.

Hours, not weeks
02

Acquire originals

Originals rather than re-shared copies, model versions and system prompts, each hashed on arrival with a custody record.

Hashes recorded
03

Analyze independently

Several independent methods per question, human examiners on every finding, and no single tool's score treated as a verdict.

Methods disclosed
04

Report

Findings with stated confidence and limits, written to be read by a judge, a board or a regulator, and explained by the examiner who reached them.

Confidence stated
Inside a case

How a case
moves.

Pick a scenario to follow it step by step. The scenarios and timings are illustrations, not real cases. Every matter is different, and we scope it only after we've looked.

Voice clone · urgent wire requestIllustrative workflow
T+00:00PRESERVEOriginal voice note secured from the messaging app, hashed, custody record opened.
T+00:30PROVENANCENo content credentials or AI watermark present; none expected from this app.
T+01:30SYNTHESISSpeech tested for text-to-speech and voice-conversion artifacts: present in most segments.
T+03:00MODELArtifact pattern consistent with a commercial voice-cloning model family.
T+04:30CROSS-CHECKSecond independent detector and an examiner listening review agree.
T+05:30REPORTFinding: consistent with AI generation. Methods, confidence and limits stated.
No single detector decides. Independent methods have to agree before we report that a model made it.
AI agent · hidden instructions followedIllustrative workflow
T+00:00CONTAINAgent paused, not deleted. System prompt, permissions and tool definitions captured.
T+00:40PRESERVEModel, tool-call and provider logs exported; provider asked to preserve its copy.
T+02:00TRACERun rebuilt: the agent read a supplier PDF carrying hidden instructions.
T+03:20ACTIONSTwo tool calls followed the injected text, not the user's request.
T+05:00CAUSEEach action tied to the prompt content that produced it.
T+06:30REPORTInjection path, actions taken, and the controls that would have stopped it.
Indirect prompt injection: the attacker never touched your systems. The instructions arrived inside a document the agent was asked to read.
Onboarding · synthetic identity approvedIllustrative workflow
T+00:00PRESERVESelfie video, ID images and session records exported from the verification vendor.
T+00:45SESSIONDevice reported a virtual camera; video frames arrived with no sensor noise.
T+02:00FACESelfie video shows face-swap blending and temporal flicker around the jawline.
T+03:30DOCUMENTID image carries generator traces; layout matches a known AI template.
T+05:00RINGSame template and camera signature found on 37 other applications.
T+06:30REPORTAttack method, linked applications and the checks that missed it.
Camera injection skips the camera entirely. The liveness check never saw a real face, only a stream it was told was one.
On-chain · stolen tokens tracedIllustrative workflow
T+00:00INTAKEVictim's transaction hashes and addresses recorded; no wallet access needed.
T+00:40TRACEFunds followed through 14 hops and a token swap within the first hour.
T+02:00BRIDGEBridge transaction matched to its destination on a second chain.
T+03:30CLUSTERDestination addresses clustered by shared funding and spending patterns.
T+05:00EXITPart of the funds reached deposit addresses at two regulated exchanges.
T+06:00REPORTTracing report for the exchanges' freeze requests and for counsel.
The ledger is public, so speed matters more than access. Funds that reach a regulated exchange can often be frozen if the trace arrives in time.
The lab and TechFusion

Where TechFusion ends,
Data Labs begins.

Data Labs is a division of TechFusion: same company, same headquarters in Belmont, Massachusetts, same chain-of-custody standards. It takes only the problems generative AI and blockchains created. Everything else TechFusion does, from data recovery to incident response, stays at techfusion.com.

TechFusion · since 1988

Classic recovery and forensics

  • Data recovery: drives, SSD, RAID, NAS, tape, phones
  • Computer, mobile, social media and vehicle forensics
  • Audio, video and image forensics, metadata
  • Incident response, hacking and spyware cases
  • E-discovery, internet investigations, password cracking
  • Ransomware recovery and cybersecurity assessments
Go to techfusion.com
TechFusion Data Labs · now

AI-era forensics

  • Synthetic media detection
  • AI agent forensics
  • Model and training-data forensics
  • Identity-verification attacks
  • AI decision forensics and bias audits
  • On-chain forensics
Start a case
Assurance

Findings you
can check.

New techniques draw hard questions in court. Our reports answer them up front: what we did, why it is reliable, and what it cannot tell you.

Chain of custody

Every exhibit, log export and model snapshot is hashed and logged from arrival to return.

Methods disclosed

Each finding names its methods, its confidence and its limits, so the other side can test it.

Humans decide

AI tools assist the examiners. A qualified person reaches and signs every conclusion.

Confidential by default

NDAs on request, need-to-know access, encrypted delivery and secure disposal at close.

Questions

Before you call.

Can you tell whether a recording or video was made by AI?

Often we can give strong evidence one way or the other, from the traces generators leave, provenance data such as content credentials and AI watermarks, and how the file travelled. Sometimes the honest answer is "inconclusive", and we say so. We never rely on a single detection tool, because detectors can be fooled and go out of date.

What should we preserve after an AI agent incident?

Pause the agent; don't delete it. Keep its system prompt, permissions, connected tools and the content it processed, export its conversation and tool-call logs, and ask your AI provider to preserve theirs. Then call us.

Can you tell whether our data was used to train an AI model?

Sometimes. Depending on the model and access, membership and memorization tests can produce evidence that specific material was seen in training. Results are probabilistic and we explain their weight. For disputes, we work with your counsel on what discovery can add.

Can you audit our hiring or lending model for bias?

Yes. We test outcomes across groups, document the method and data, and report the results in the form auditors and regulators expect, including bias audits for automated employment decision tools where local law requires them.

Can you trace stolen crypto?

Usually, as far as the public ledger allows: across wallets, mixers, bridges and chains, up to the exchanges and services where funds can be frozen or subpoenaed. We package the trace so exchanges, law enforcement and courts can act on it. We don't access wallets or recover passwords.

How is this different from TechFusion's services?

Nothing at Data Labs repeats a TechFusion service. Data recovery, computer and phone forensics, audio and video forensics, incident response, spyware and hacking cases, e-discovery, internet investigations, password cracking, ransomware recovery and security assessments are all techfusion.com. Data Labs takes only the problems generative AI and blockchains created.

Evidence expires

Tell us what happened.
We'll tell you what can be proved.

A confidential first consultation, a clear scope and quote, and no work until you say go.

Start a case Call 617-491-1001
Mon–Fri 10am–5pm · Emergency hours by appointment