Mobile evidence guidance
Can mobile evidence reveal whether an image, voice note or video was AI-generated?
Sometimes the available material can support a finding about creation or editing, but there is no universal test that proves every item genuine or detects every manipulation. Assess provenance, the actual file, associated records and appropriately evaluated technical methods.
Start with the item and its history
Preserve the supplied file in its received form and record where it came from. Establish whether it is an original recording, a downloaded attachment, a forwarded copy, a screen recording or a screenshot of another item. Identify relevant source devices, editing history, exports and surrounding communications where available.
These are different representations. Compression, cropping, transcoding and re-recording can change what can be examined. Missing metadata or a changed file hash does not, on its own, prove fabrication.
Separate provenance from the truth of the event
Content Credentials can provide signed provenance information for a particular asset. Verification concerns the available credential and its trust context; it does not by itself prove that the scene depicted is truthful. An absent credential is not, by itself, evidence that an item is fake.
Treat detector results as limited technical observations
Consider a detector result with its intended use, relevant testing, input conditions and known limitations. A score must not be presented as the probability that a named person fabricated the material unless that interpretation is independently justified. Conflicting or inconclusive results should be recorded, not resolved by selecting the most convenient output.
Ask the right attribution question
Establishing that editing or generation occurred is different from identifying who performed it, whether another person knew about it or whether the surrounding communication is accurate. A shared account, forwarded file or exported conversation can complicate attribution.
Define the instruction before promising a result
Specify the item, disputed proposition and original material available. Specialist media or speaker-comparison expertise may be required and should be agreed separately. No particular detection service, success rate or universally supported media type is claimed by this guidance.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- C2PA Content Credentials explainer, specification 2.2
Provenance validation does not determine whether depicted events are true.
Technical documentation · Documentation checked
- NIST AI 100-4: Reducing Risks Posed by Synthetic Content (2024)
Background on provenance, labelling, detection and testing; not validation of a detector.
Research background · Documentation checked
Confidential case review
