Authors: ChaeMin Park, JuHwan Park, Dohyun Kim
DFRWS APAC 2026
Abstract
Traditional digital forensics analyzes artifacts that directly record user actions, such as logs and ap plication databases. As on-device AI becomes common, however, AI residue — data derived from user content, such as facial feature vectors — can also serve as digital evidence. Using the people-tag feature of Samsung Gallery as a case study, this paper reverse-engineers the on-device face-clustering pipeline (static analysis with Ghidra, dynamic analysis with Frida) and quantitatively evaluates the forensic value and persistence of the resulting residue, with four contributions. (i) We document the pipeline from face detection to GCN clustering, including five decision thresholds and the extraction failure boundary (|| ≥ 38◦), and release an open-source tool that reproduces it; tool- and device generated vectors match at mean cosine 0.9512 ( = 2,440). (ii) With external reference images, the tool identifies registered persons at TPR 95.62% and detects permanently deleted persons at 95.67%. (iii) To our knowledge, this is the first quantification of how long deleted vectors persist in face_data: block reuse is deterministic (smallest-unreferenced-first, 100% predicted-vs-observed match), giving survival of 90 = 83 and 50 = 385 newly registered faces. (iv) Eight differential-residue rules distin guish normal use from intentional concealment (1 = 1.0), and person data is redundantly stored in the system-protected media.db, auto-restoring after user-level app-data deletion. These findings estab lish AI residue as a distinct class of digital evidence.