Foundations for Investigations of Agentic AI Systems from the Forensic Analysis of OpenClaw

The gist: This work presents an empirical study of OpenClaw, a widely used single-agent assistant, to establish an initial foundation for the systematic investigation of agentic AI by proposing an agent artifact taxonomy.

Motivation and Problem

Agentic AI systems are increasingly deployed as personal assistants and are likely to become a common object of digital investigations Little is known about how their internal state and actions can be reconstructed during forensic analysis The central forensic question is not only what happened on the host, but what the assistant actually did versus what the user requested, knew, or intended—an attribution problem that current forensic understanding struggles to resolve. This work addresses this gap by establishing the foundation for the forensic examination of AI assistants.

Methodology

The study examines OpenClaw’s technical design via static code analysis and applies differential forensic analysis to identify recoverable traces across stages of the agent interaction loop. The experiment was conducted in a virtualized environment managed by Oracle VirtualBox, the guest virtual machine operated on Debian GNU/Linux 13 (Codename: Trixie). The analysis combined static code analysis, differential analysis, and file inspection to locate and interpret relevant traces. Specifically, differential forensic analysis allowed the researchers to isolate the specific effects of an action by comparing the differences between two sequential images.

Artifact Taxonomy

The researchers propose an agent artifact taxonomy that captures recurring investigative patterns. This functional taxonomy is organized into five artifact planes, each corresponding to a distinct aspect of the agent’s architecture. The five planes are:

1. Reasoning & Cognition (“The Brain”): How it thinks.

2. Identity & Configuration (“The DNA”): What it is / could do.

3. Knowledge & Recall (“The Memory”): What it knows.

4. Communication & I/O (“The Ears & Mouth”): How info flows.

5. Actions & Effects (“The Hands”): What it did.

Key Artifacts and Traces

Session transcripts are described as the single richest forensic artifact in the system, as they record not only communication but also reasoning traces, tool invocations, and context state. Within a session, individual user interactions are executed as runs. Run progression can be traced through debug log messages that mark stages such as prompt start, agent start, tool execution, agent end, and prompt end. Log data is stored in /tmp/openclaw/. The retention policy is hard-coded: log files older than 24 hours are deleted.

Challenges for Investigation

Agentic execution introduces an additional layer of abstraction and substantial nondeterminism in trace generation. The LLM, the execution environment, and the evolving context can influence tool choice and state transitions in ways that are largely absent from rule-based software. This nondeterminism is caused by sampling stochasticity, context assembly variability, and timing-dependent external state. Furthermore, the relevant context that shaped a decision is difficult to reconstruct retrospectively because the workspace environment, memory, and capabilities naturally evolve and change over time.

Implications for Forensics

The analysis highlights that structural artifacts, such as configuration files and credential stores, remained deterministic across runs. Conversely, agent-generated artifacts whose creation depends on LLM-mediated planning and tool choice exhibit variation. This suggests two qualitatively different classes of traces that require distinct analytical approaches. The proposed taxonomy provides a viable foundation for the systematic investigation of agentic assistants.

Conclusion

Agentic AI systems are becoming a durable part of the software ecosystem, and their delegated and context-dependent execution challenges long-standing forensic assumptions about reproducibility, provenance, and the completeness of local traces. The work provides an analysis tool as open-source software to structure investigations of agentic assistants. The findings underscore the need for sustained, systematic forensic research of agentic systems.

How it works

The analysis procedure involved three main steps:

1. Static code analysis provided an overview of the application’s architecture and potential data storage locations before generating any user data.

2. Differential forensic analysis was applied to isolate the specific effects of an action by comparing the differences between two sequential images. This tool detects changes across five specific categories: file or directory creation, deletion, renaming, content modification, and timestamp updates.

3. The remaining candidates of file system changes were subsequently verified and inspected in-depth using standard forensic tooling.

Artifact Examination Tool

The artifact-examiner, a Python-based command-line interface (CLI) tool, was developed to facilitate the analysis of OpenClaw. This tool offers several capabilities for investigators:

"Unified Timeline Analysis: It reconstructs a chronological view of all agent activities by merging events from logs, session transcripts, and configuration changes allows analysts to trace the sequence of actions leading up to a specific event"

Session Inspection: The tool provides interactive browsers for exploring agent sessions, including the ability to reconstruct conversation flows, tool invocations, and subagent spawns

Forensic Artifact Definition

A technical and concise description of forensic artifacts is provided via the artifacts/data/openclaw.yml file. This YAML file serves as a machinereadable schema that defines the location, structure, and semantic meaning of important artifacts generated by the OpenClaw agent. Each artifact entry includes Name, Documentation, and Sources.

Cross-System Mapping

The taxonomy was validated against artifacts reported by Walker et al. [23] for the agentic framework AutoGen and by Dragonas et al. [7] for the non-agentic ChatGPT mobile application. This mapping reveals a discriminative pattern where reasoning traces and actions are absent in the non-agentic system. The taxonomy was developed through a combination of literature review on agentic system architectures, code analysis as well as differential analysis, and validated against the abstract agent interaction loop described in Section 2.1.

Summary of Artifact Planes

The five planes capture analogous aspects of an AI agent:

"Reasoning & Cognition (“The Brain”): How it thinks Captures the LLM’s reasoning traces—a category of forensic evidence with no analog in traditional software"

"Identity & Configuration (“The DNA”): What it is / could do Encompasses the predominantly static artifacts that define the agent’s configured identity, capabilities, and operational boundaries"

"Knowledge & Recall (“The Memory”): What it knows Covers accumulated knowledge such as episodic memory, user profiles, and semantic indices—distinguished from DNA by being accumulated at runtime, often by the agent itself"

"Communication & I/O (“The Ears & Mouth”): How information flows to and from the agent Establishes who interacted with the agent, through which channels, and what each party could observe"

"Actions & Effects (“The Hands”): What it did Records concrete actions and their observable effects, providing the factual basis for determining what changes the agent caused"

Cross-Cutting Evidence

Session transcripts are cross-cutting and contribute direct or indirect evidence to multiple planes. A single JSONL file directly records reasoning traces (Brain), user and agent messages (Ears & Mouth), and tool invocations (Hands).

1. Establish a systematic forensic methodology by applying an agent artifact taxonomy to classify evidence across five planes: Reasoning & Cognition, Identity & Configuration, Knowledge & Recall, Communication & I/O, and Actions & Effects. This allows for a structured investigation of agentic systems by addressing questions such as How is the agent configured? and What information had the agent accumulated?

2. Implement enhanced context reconstruction by correlating modified timestamps of context-providing files with session transcript entries to approximate the knowledge state that was active during the relevant period. This helps investigators determine which context was available to the LLM at a specific point in time, addressing the challenge where the same request can produce different outcomes at different points in time.

3. Develop capabilities for autonomous action attribution by utilizing run history and subagent delegation records to determine Did the agent execute unprompted or autonomous actions? This allows for classifying observed actions on a spectrum: directly instructed by the user, interpretively derived from an ambiguous instruction, autonomously initiated by the agent, or indeterminate.

4. Improve model-mediated reasoning analysis by specifically identifying and analyzing chain-of-thought blocks within assistant messages, which can reveal how the agent interpreted a request, which alternatives it considered, and why it selected a particular tool. This provides insight into the decision-making process that is otherwise largely absent from traditional software forensics.

5. Enhance communication tracing by parsing structured headers in message content (e.g., Telegram messages) to extract channel attribution, sender identity (e.g., display name, username, platform-specific user ID), and message timestamp, providing a clearer view of who interacted with the agent and through which channels.