AI Agents X Digital Forensics
As Artificial Intelligence evolves from passive tools to autonomous agents capable of independent action, a new digital forensics subject has emerged: the forensic analysis of AI tooling on a given system.
This article is the third chapter in an exclusive series dedicated to our latest research in identifying and exploiting the artifacts left behind by these programs.
As AI agents navigate operating systems and execute complex tasks, they etch digital signatures into logs, memory, and file structures; our goal is to reveal how investigators can decode these remnants to reconstruct the actions undertaken using such tools in modern forensic investigations.
This third article will be focused on the ClaudeCode coding agent.
What is ClaudeCode?
Claude Code is Anthropic‘'s agentic AI tool designed to autonomously read codebases, execute complex multi-file edits, and run tests directly from your terminal. Unlike standard chat assistants, it acts as an active agent to manage and commit coding workflows.
Valuable forensic artifacts
ClaudeCode configuration folder
A folder used for Claude Code configuration files can be found in C:\Users\ Claude on Windows.
In this folder we can find several forensically interesting files:
settings.json: stores configuration for Claude Code.history.jsonl: stores user prompts history in fielddisplaywithtimestamp,projectandsessionIdpolicy-limits.json: stores policies and restrictions
ClaudeCode plugins related data
It is possible to find installed plugins in C:\Users\ \.claude\plugins\installed_plugins.json
Known marketplaces can be found in C:\Users\ \.claude\plugins\known_marketplaces.json
ClaudeCode projects related data
The full history of a project can be found in C:\Users\ \.claude\projects\ \*.jsonl files.
These files contain much more information than the history.jsonl file as it includes responses from the agent.
Some fields in an agent response are particularly useful, including but not limited to:
parentUuid: message the agent is responding totimestampsessionIdcwd: the current working directorymessage.model: the model used to respond to user promptmessage.content.textthe agent's responsemessage.content.type==tool_use: a tool has been called by the agent which can be a command line utility, MCP calls, etc.
