Discovery tools list which AI tools are installed. We reconstruct the timeline: when each tool was used, which documents were open at the time, what the vendor's terms said that day, and how certain each finding is.
Chrome keeps about 90 days of browsing history. Every week you wait, the oldest week disappears.
In February 2026, in United States v. Heppner, a federal court in New York held that documents a defendant created using a consumer AI tool were not protected by privilege. If your people used consumer AI tools for client work, the question is no longer whether it matters, but what can still be shown about it.
Read it before you run it. The free scanner is a short PowerShell script for Windows. It checks Chrome, Edge and the ChatGPT and Claude desktop apps, and lists which AI tools have left folders on the machine and when each was last active. It reads folder names and timestamps only. It never opens a file and does not read file contents at all. That is deliberate: a tool a privacy officer has to block is a tool nobody runs.
Quoted on the procurement diagnostics layer in Quantamix Solutions' five-layer EU AI Act audit-trail architecture (May 2026), and in Forensic Ground Truth (June 2026), alongside the VERITAS Framework creator, the Chairman of the Open Privacy Standards Foundation, and three AI governance practitioners.
DLP and SSE operate below the browser. A personal ChatGPT session on a managed laptop produces no OAuth grant, no admin log, and no network signature you can tell apart from any other HTTPS session.
Local browser storage keeps an origin-level trace of which AI services were used, and when, that survives clearing browser history.
| Free read-out | Forensic Triage | Forensic Audit | |
|---|---|---|---|
| Price | Free, one laptop | $2,500 (first three clients $1,500) | From $5,000, scoped |
| Covers | One laptop | Up to 5 laptops | Scoped in writing |
| Who collects | You, with our open-source scanner | You, with a collection script we send you | Collection under a written scope |
| What we receive | The scanner's output (folder names and dates) | The files the script collects, after you preview and remove anything you choose | Artifacts defined in writing beforehand |
| What it answers | Which AI tools are present, when each was last active, what evidence expires and when | When AI was used, which documents were open at the time, what the vendor's terms said that day, graded 1 to 5 with limitations first | The same, across more machines, with chain of custody |
| Delivery | Within 2 working days | 5 working days after we receive the file | Agreed in the scope |
| We access your machines | Never | Never | Only within written scope |
| Your data | Stays with you except the output you send | Encrypted transfer, analysed on an offline machine, deleted within 30 days with a certificate | Same |
For IT providers: you can resell the Forensic Triage at your own price. Ask us for the terms.
Most people start with the free read-out or the Forensic Triage. The Forensic Audit is from $5,000, scoped, and available after a Forensic Triage.
Not prompts, not responses, not files. It reads folder names and timestamps. Nothing else.
The scanner makes no network calls. The report is written locally and you choose whether to send it.
It reports which services have data on a device. It does not report what anyone typed, and it cannot.
It tells you what to go and check.
Already know which tools you're running? Read what their vendors actually say:Healthcare ·Financial services ·Legal
Thanks — we'll be in touch within 1 business day. For anything urgent, email adil@shadowaiforensics.com directly.