TechFusion has examined digital evidence since 1988. Data Labs is its division for evidence that generative AI and blockchains created: cloned voices and faces, AI agents that acted without approval, disputed models and training data, automated decisions, and crypto that moved on-chain.
A voice can be cloned in minutes. An AI agent can take actions no person typed. A customer who passed every identity check may not exist. The questions courts, boards and regulators ask are the same as ever: what happened, and can you prove it?
01 / Synthetic media
A familiar voice or face can be fake.
Cloned voices approve wire transfers. Face-swapped executives join video calls. In 2024 an engineering firm's Hong Kong office paid out about US$25 million after a video call in which the other participants were deepfakes.
Agents send email, call APIs and move data on their own. When one is hijacked, the evidence is in prompts, retrieved documents and tool calls, and it often expires quickly.
A generated face, a synthetic ID and a fake camera feed can pass a selfie check. Fraud teams need to know how it got through, and whether it was one person or a ring.
Models now screen candidates, price insurance and approve credit. When a decision is challenged, the question is why the system decided as it did, and whether it treats groups differently.
Stolen funds hop across wallets, mixers and bridges in minutes. The blockchain records every hop. Turning that record into a trace an exchange or a court will act on takes careful work.
Each practice deals with evidence that generative AI or blockchains created. We use AI tools where they help and never let a single detector's score stand in for an examiner's finding.
Synthetic Media Detection
Was this voice, video, image or document made or altered by a generative AI model? Examined for the traces generators leave, reported with stated confidence.
Onboarding and liveness checks are now attacked with deepfaked selfies, injected camera feeds and AI-made ID documents. We establish how a synthetic identity got through.
When an automated system denies a loan, rejects a candidate or flags a claim, someone has to explain why. We reconstruct the decision and test the system for bias.
Following crypto across public blockchains: where stolen or disputed funds went, which addresses belong together, and how a smart-contract exploit worked.
Evidence is easiest to prove when it was kept on purpose. These programs set that up before anything goes wrong, and the retainer puts an examiner on call.
Deepfake response retainer
A named examiner on call, a verification protocol for payment and executive requests, and a playbook for when a synthetic version of your leadership appears.
AI agent traceability review
Whether your agents and copilots record prompts, retrieved content and tool calls well enough to reconstruct an incident, and how to fix it before you need it.
Content credentials program
Signing your own photos, video and statements with C2PA content credentials, so your genuine media can be told apart from fakes of it.
Bias audit program
Recurring independent bias testing of the automated tools you use to hire, lend or price, with the documentation regulators ask for.
Method
Preserve first. Prove second.
New kinds of evidence, the same discipline. AI providers purge conversations, platforms re-encode uploads, and agent logs roll over, so preservation comes before anything else.
01
Preserve fast
Original media, agent logs and model snapshots secured in the first hours, with preservation requests to AI providers and platforms.
Hours, not weeks
02
Acquire originals
Originals rather than re-shared copies, model versions and system prompts, each hashed on arrival with a custody record.
Hashes recorded
03
Analyze independently
Several independent methods per question, human examiners on every finding, and no single tool's score treated as a verdict.
Methods disclosed
04
Report
Findings with stated confidence and limits, written to be read by a judge, a board or a regulator, and explained by the examiner who reached them.
Confidence stated
Inside a case
How a case moves.
Pick a scenario to follow it step by step. The scenarios and timings are illustrations, not real cases. Every matter is different, and we scope it only after we've looked.
T+00:00INTAKEVictim's transaction hashes and addresses recorded; no wallet access needed.
T+00:40TRACEFunds followed through 14 hops and a token swap within the first hour.
T+02:00BRIDGEBridge transaction matched to its destination on a second chain.
T+03:30CLUSTERDestination addresses clustered by shared funding and spending patterns.
T+05:00EXITPart of the funds reached deposit addresses at two regulated exchanges.
T+06:00REPORTTracing report for the exchanges' freeze requests and for counsel.
The ledger is public, so speed matters more than access. Funds that reach a regulated exchange can often be frozen if the trace arrives in time.
The lab and TechFusion
Where TechFusion ends, Data Labs begins.
Data Labs is a division of TechFusion: same company, same headquarters in Belmont, Massachusetts, same chain-of-custody standards. It takes only the problems generative AI and blockchains created. Everything else TechFusion does, from data recovery to incident response, stays at techfusion.com.
TechFusion · since 1988
Classic recovery and forensics
Data recovery: drives, SSD, RAID, NAS, tape, phones
Computer, mobile, social media and vehicle forensics
Audio, video and image forensics, metadata
Incident response, hacking and spyware cases
E-discovery, internet investigations, password cracking
New techniques draw hard questions in court. Our reports answer them up front: what we did, why it is reliable, and what it cannot tell you.
Chain of custody
Every exhibit, log export and model snapshot is hashed and logged from arrival to return.
Methods disclosed
Each finding names its methods, its confidence and its limits, so the other side can test it.
Humans decide
AI tools assist the examiners. A qualified person reaches and signs every conclusion.
Confidential by default
NDAs on request, need-to-know access, encrypted delivery and secure disposal at close.
Questions
Before you call.
Can you tell whether a recording or video was made by AI?
Often we can give strong evidence one way or the other, from the traces generators leave, provenance data such as content credentials and AI watermarks, and how the file travelled. Sometimes the honest answer is "inconclusive", and we say so. We never rely on a single detection tool, because detectors can be fooled and go out of date.
What should we preserve after an AI agent incident?
Pause the agent; don't delete it. Keep its system prompt, permissions, connected tools and the content it processed, export its conversation and tool-call logs, and ask your AI provider to preserve theirs. Then call us.
Can you tell whether our data was used to train an AI model?
Sometimes. Depending on the model and access, membership and memorization tests can produce evidence that specific material was seen in training. Results are probabilistic and we explain their weight. For disputes, we work with your counsel on what discovery can add.
Can you audit our hiring or lending model for bias?
Yes. We test outcomes across groups, document the method and data, and report the results in the form auditors and regulators expect, including bias audits for automated employment decision tools where local law requires them.
Can you trace stolen crypto?
Usually, as far as the public ledger allows: across wallets, mixers, bridges and chains, up to the exchanges and services where funds can be frozen or subpoenaed. We package the trace so exchanges, law enforcement and courts can act on it. We don't access wallets or recover passwords.
How is this different from TechFusion's services?
Nothing at Data Labs repeats a TechFusion service. Data recovery, computer and phone forensics, audio and video forensics, incident response, spyware and hacking cases, e-discovery, internet investigations, password cracking, ransomware recovery and security assessments are all techfusion.com. Data Labs takes only the problems generative AI and blockchains created.
Evidence expires
Tell us what happened. We'll tell you what can be proved.
A confidential first consultation, a clear scope and quote, and no work until you say go.