Forensics of Operating System Non-Agentic AI Activity Traces
Background: As we have finished our research on agentic AI solutions, let's deep dive into one of the common non-agentic AI features implemented in the latest Windows OS. The name of this feature is Copilot.
By default, Copilot is not installed in the OS as a single application. Copilot exists for Office for Windows and for other types of Microsoft products.
At the same time, we should consider the fact that if we are conducting forensic analysis involving the noted AI solution, there will not be many artifacts left on the Windows OS, such as prompt metadata and similar information.
Copilot for windows: As a result of forensic analysis, we know that the solution is using the Edge browser under the hood, but in a specific way. The solution itself is available in the Microsoft App Store. Therefore, if you need to understand how AI Copilot is used, the first step should be to get the list of Windows packages installed from the Windows Store using PowerShell. Only after completing this step should you proceed to the next stages of your analysis.
Get-AppxPackage -Name Microsoft.Copilot
In the next step, we need to investigate the next piece of the puzzle. As previously mentioned, the solution operates in cooperation with Edge. Through in-depth forensic analysis, you may discover that the integration uses a format similar to CRX, which is the standard format for browser extensions.
C:\Users\YOURUSERNAME\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Based on checking we see that CRX id is "khiogjgiicnghciboipemonlmgelhblf"
On next step we can deep dive one layer deeper over HIVE and search for that artifacts .
The next artefact which we can find as result of shim work . The artifact is inside
C:\Users\YOURUSERNAME\AppData\Local\Microsoft\Edge\User Data\Local State
Conclusion: Unfortunately, neither Sysmon nor configuration files reveal the chat history of Copilot. This means you will need to rely on other artifacts to uncover the logs.