A media file is one part of a creation or editing workflow. When the question concerns whether and how an AI service was used, preserve the surrounding records as separate evidence objects. A plausible image cannot reconstruct a missing conversation, and a conversation describing an output does not automatically identify the exact received file.
Define the workflow question
Distinguish media origin, editing history, account activity, and identity. Write the precise question and the records that could answer it. An application export may support a sequence of interactions while leaving the identity of the person operating the account unresolved. A provenance manifest may record assertions about an object without establishing the truth of the depicted scene. Avoid a single authenticity label that hides these separate issues.
Preserve the received object
Keep the received bytes, delivery context, filename, size, digest, and acquisition time. Identify whether the object is a native file, platform download, screenshot, thumbnail, recording, or recompressed derivative. Maintain the relationship between versions rather than replacing an earlier item with a cleaner one. Record the exact preparation used for any later examination or detector submission.
Collect application context within scope
Where authorized and available, preserve relevant native exports, conversation identifiers, prompts, attachments, output identifiers, timestamps with their basis, and visible edit history. Describe how those records were acquired. A copied text transcript may omit structure or attachments, so retain the export format and document known omissions. Record model or service version as supplied by the source; do not infer an undisclosed internal model from the appearance of an answer.
Link objects with evidence
Use explicit relationships: this attachment belongs to this conversation record; this downloaded file is associated with this output identifier; this later image was produced from this preserved input according to these records. Identify the basis for each relationship. A shared filename is weaker than a verified byte match. Keep unresolved relationships marked as unresolved instead of connecting every nearby item into one seamless story.
Preserve transformations and verification output
Document cropping, resizing, transcoding, annotation, extraction, and other analysis steps. Keep provenance manifests and verifier output in the forms actually obtained, with implementation and trust configuration where available. If a detector is used, preserve its version, parameters, input preparation, and complete result. The result belongs in the method record; it does not replace the underlying object or establish a person's actions.
Report the supported workflow
Present the preserved sequence, missing steps, and alternative explanations. Separate a service record of an action from a conclusion that the depicted event occurred. If no native workflow record survives, say which origin questions remain open. A careful partial reconstruction is more useful than a confident narrative assembled from file appearance and assumed platform behavior.
- Understand provenance and detector limits
Keep cryptographic checks, assertions, and statistical outputs separate.
- Verify an application export
Document the requested scope and the delivered material.