As cited
Copy frozen at (site build).
research
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review
Two new Python scripts enable forensic reconstruction of activity from artificial intelligence (AI) coding assistants: opencode-chat-replay.py extracts and converts OpenCode session data from SQLite into readable Markdown or structured JSON, JSON, or JSONL transcripts, while hermes_forensic_extract.py extracts broader artifacts from Hermes including conversations, application programming interface (API) request payloads, model usage, and application logs into newline-delimited JSON. Both tools work from mounted evidence images or collected system data, support time-range filtering, and operate read-only without modifying original data.
Why it matters: Incident responders and forensic examiners investigating systems where AI agents executed code need methods to reconstruct what was requested, what the AI returned, what tools it invoked, and what logs remain available for review.
- Source published
- First seen by Cybersecurity Tracker