Agentic Al systems are increasingly deployed as personal assistants and are likely to become a common object of digital investigations. However, little is known about how their internal state and actions can be reconstructed during forensic analysis. Despite growing popularity, systematic forensic approaches for such systems remain largely unexplored. This paper presents an empirical study of OpenClaw a widely used single-agent assistant. We examine OpenClaw's technical design via static code analysis and apply differential forensic analysis to identify recoverable traces across stages of the agent interaction loop. We classify and correlate these traces to assess their investigative value in a systematic way. Based on these observations, we propose an agent artifact taxonomy that captures recurring investigative patterns. Finally, we highlight a foundational challenge for agentic Al forensics: agent-mediated execution introduces an additional layer of abstraction and substantial nondeterminism in trace generation. The large language model (LLM), the execution environment, and the evolving context can influence tool choice and state transitions in ways that are largely absent from rule-based software. Overall, our results provide an initial foundation for the systematic investigation of agentic Al and outline implications for digital forensic practice and future research.

翻译：智能体AI系统正日益被部署为个人助手，并有望成为数字调查的常见对象。然而，关于如何在取证分析中重建其内部状态和行为，目前仍知之甚少。尽管此类系统越来越普及，但针对它们的系统化取证方法在很大程度上仍属空白。本文对广泛使用的单智能体助手OpenClaw进行了实证研究。我们通过静态代码分析审视了OpenClaw的技术设计，并应用差分取证分析来识别跨智能体交互循环各阶段的可恢复痕迹。我们对这些痕迹进行分类和关联，以系统化方式评估其调查价值。基于这些观察，我们提出了一种智能体工件分类法，用以捕捉重复出现的调查模式。最后，我们揭示了智能体AI取证面临的一个基础性挑战：智能体驱动的执行引入了一个额外的抽象层，并在痕迹生成中带来了显著的非确定性。大语言模型（LLM）、执行环境以及不断演变的上下文会以规则型软件中基本不存在的方式影响工具选择和状态转换。总体而言，我们的研究结果为智能体AI的系统性调查提供了初步基础，并概述了对数字取证实践及未来研究的启示。