Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw

• URL: http://arxiv.org/abs/2604.05589v1
• Date: Tue, 07 Apr 2026 08:35:22 GMT
• Title: Foundations for Agentic AI Investigations from the Forensic Analysis of OpenClaw
• Abstract summary: Agentic Al systems are increasingly deployed as personal assistants and are likely to become a common object of digital investigations.<n>This paper presents an empirical study of OpenClaw a widely used single-agent assistant.<n>We classify and correlate these traces to assess their investigative value in a systematic way.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Agentic Al systems are increasingly deployed as personal assistants and are likely to become a common object of digital investigations. However, little is known about how their internal state and actions can be reconstructed during forensic analysis. Despite growing popularity, systematic forensic approaches for such systems remain largely unexplored. This paper presents an empirical study of OpenClaw a widely used single-agent assistant. We examine OpenClaw's technical design via static code analysis and apply differential forensic analysis to identify recoverable traces across stages of the agent interaction loop. We classify and correlate these traces to assess their investigative value in a systematic way. Based on these observations, we propose an agent artifact taxonomy that captures recurring investigative patterns. Finally, we highlight a foundational challenge for agentic Al forensics: agent-mediated execution introduces an additional layer of abstraction and substantial nondeterminism in trace generation. The large language model (LLM), the execution environment, and the evolving context can influence tool choice and state transitions in ways that are largely absent from rule-based software. Overall, our results provide an initial foundation for the systematic investigation of agentic Al and outline implications for digital forensic practice and future research.

Related papers

• AI Forensics Across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems [3.340255811686752]
  We argue that investigator access is a useful starting point for organizing the field of AI forensics.<n>We propose a process model matrix for AI forensics across four phases: collection, preservation, analysis, and reporting.
  arXiv  Detail & Related papers  (2026-08-04T12:04:57Z)
• DocOps: A Verifiable Benchmark for Autonomous Agents in Complex Document Operations [106.74348504930124]
  We introduce DocOps, a deterministically verifiable evaluation framework underpinned by a hierarchical taxonomy.<n>Based on DocOps, we systematically evaluate representative closed- and open-source models across various agentic harnesses.<n>Our work exposes the capability boundaries of agents in maintaining global document consistency, shedding light on the future design of robust, non-destructive agents.
  arXiv  Detail & Related papers  (2026-07-22T07:52:59Z)
• Towards a Virtual Neuroscientist: Autonomous Neuroimaging Analysis via Multi-Agent Collaboration [53.772014300855375]
  We introduce NIAgent, a multi-agent system for autonomous end-to-end neuroimaging analysis.<n>Unlike conventional flat tool-calling agents, NIAgent adopts a code-centric execution paradigm.<n>We propose a hierarchical verification framework for autonomous quality control, integrating cohort-level metric screening with agentic visual inspection.
  arXiv  Detail & Related papers  (2026-05-10T06:30:19Z)
• Learning to Retrieve from Agent Trajectories [72.8923565916533]
  We argue that retrieval models for agentic search should be trained directly from agent interaction data.<n>We introduce learning to retrieve from agent trajectories as a new training paradigm, where supervision is derived from multi-step agent interactions.<n>Our results highlight agent trajectories as a practical and scalable supervision source, pointing to a promising direction for retrieval in the era of agentic search.
  arXiv  Detail & Related papers  (2026-03-30T17:59:02Z)
• AgentFoX: LLM Agent-Guided Fusion with eXplainability for AI-Generated Image Detection [21.02452809723292]
  We present textbfAgentFoX, a framework that redefines AIGI detection as a dynamic, multi-phase analytical process.<n>Our approach employs a quick-integration fusion mechanism guided by a curated knowledge base.<n>AgentFoX produces a detailed, human-readable forensic report that substantiates its verdict.
  arXiv  Detail & Related papers  (2026-03-24T12:10:21Z)
• LLM-driven Provenance Forensics for Threat Investigation and Detection [12.388936704058521]
  PROVSEEK is an agentic framework for provenance-driven forensic analysis and threat intelligence extraction.<n>It generates precise, context-aware queries that fuse a vectorized threat report knowledge base with data from system provenance databases.<n>It resolves provenance queries, orchestrates multiple role-specific agents to mitigate hallucinations, and synthesizes structured, ground-truth verifiable forensic summaries.
  arXiv  Detail & Related papers  (2025-08-29T04:39:52Z)
• Propose and Rectify: A Forensics-Driven MLLM Framework for Image Manipulation Localization [49.71303998618939]
  This paper presents a novel Propose-Rectify framework that bridges semantic reasoning with forensic-specific analysis.<n>Our framework ensures that initial semantic proposals are systematically validated and enhanced through concrete technical evidence, resulting in comprehensive detection accuracy and localization precision.
  arXiv  Detail & Related papers  (2025-08-25T12:43:53Z)
• FEAT: A Multi-Agent Forensic AI System with Domain-Adapted Large Language Model for Automated Cause-of-Death Analysis [13.589362185995611]
  Forensic cause-of-death determination faces systemic challenges, including workforce shortages and diagnostic variability.<n>We introduce FEAT, a multi-agent AI framework that automates and standardizes death investigations through a domain-adapted large language model.<n>In evaluations across diverse Chinese case cohorts, FEAT outperformed state-of-the-art AI systems in both long-form autopsy analyses and concise cause-of-death conclusions.
  arXiv  Detail & Related papers  (2025-08-11T13:05:59Z)
• Deep Research Agents: A Systematic Examination And Roadmap [109.53237992384872]
  Deep Research (DR) agents are designed to tackle complex, multi-turn informational research tasks.<n>In this paper, we conduct a detailed analysis of the foundational technologies and architectural components that constitute DR agents.
  arXiv  Detail & Related papers  (2025-06-22T16:52:48Z)
• GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models [0.08192907805418582]
  Cyber timeline analysis is crucial in Digital Forensics and Incident Response (DFIR)<n>Traditional methods rely on structured artefacts, such as logs and metadata, for evidence identification and feature extraction.<n>This paper introduces GenDFIR, a framework leveraging large language models (LLMs), specifically Llama 3.1 8B in zero shot mode, integrated with a Retrieval-Augmented Generation (RAG) agent.
  arXiv  Detail & Related papers  (2024-09-04T09:46:33Z)
• Understanding metric-related pitfalls in image analysis validation [59.15220116166561]
  This work provides the first comprehensive common point of access to information on pitfalls related to validation metrics in image analysis. Focusing on biomedical image analysis but with the potential of transfer to other fields, the addressed pitfalls generalize across application domains and are categorized according to a newly created, domain-agnostic taxonomy.
  arXiv  Detail & Related papers  (2023-02-03T14:57:40Z)
• Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events [7.219077740523683]
  Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems.
  arXiv  Detail & Related papers  (2020-12-02T14:14:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.