AI Agents X Digital Forensics
As Artificial Intelligence evolves from passive tools to autonomous agents capable of independent action, a new digital forensics subject has emerged: the forensic analysis of AI tooling on a given system.
This article serves as the opening chapter in an exclusive series dedicated to our latest research in identifying and exploiting the artifacts left behind by these programs.
As AI agents navigate operating systems and execute complex tasks, they etch digital signatures into logs, memory, and file structures; our goal is to reveal how investigators can decode these remnants to reconstruct the actions undertaken using such tools in modern forensic investigations.
This first article will be focused on the OpenCode coding agent.
What is OpenCode?
OpenCode is an open source AI coding agent available as a CLI interface, desktop application and IDE extension.
It is developed by Anomaly Innovations Inc.
Valuable forensics artifacts
OpenCode Config folder
A folder used for OpenCode configuration files can be found in :
C:\Users\<username>\.config\opencode on Windows.
In this folder, the file opencode.json is forensically interesting because it stores configuration for OpenCode. For example, you can identify external providers, plugins or MCPs installed.
OpenCode Data folder
A folder used by OpenCode to store cached data can be found in :
C:\Users\<username>\.local\share\opencode on Windows.
This folder contains the following elements :
auth.json
This file contains authentication information such as API keys.
opencode.db
The most valuable artifact is the opencode.db which is a SQLite database storing sessions, messages, projects, workspaces, etc.
It contains the following elements :
"session" table
This table contains elements related to sessions made in OpenCode.
Interesting fields :
id: session idtitle: session titleshare_url: if the session was shared else NULLtime_created: session creation timetime_updated: session last update timemodel: json data containing model informationid: model idprovider: model provider name
tokens_input: input tokens consumedtokens_output: output tokens consumed
"part" table
This table contains OpenCode’s message history.
If in json field data, type = text and there is a time field, then entry is the model response with :
data.text: model responsedata.time.start: response start timedata.time.end: response end timesession_id: session id correlated withsessiontableid(useful to know which model was used)
Else if in json field data, type = text and there is no time field, entry is the user message with :
data.text: user messagesession_id: session id correlated withsessiontableid(useful to know which model was used)time_created: user message creation time
