Technical findings on AI tool artifact persistence, browser forensics, and what the data shows when you look past the UI. Verifiable by any practitioner with Chrome installed.
We publish corrections when our own tests change the result.
On 1 May 2026 (Windows 10, Chrome 147.0.7727.137), a browser-based ChatGPT conversation containing a synthetic record was deleted through the interface, and the record was afterwards recovered from local browser storage. That is what this paper documents. We repeated the test in October 2026 on Chrome 154 and it did not reproduce: no chat text was found in the browser's local storage or cache. The May result is a record of what that version stored. It is not a current capability, and we do not offer recovery of deleted ChatGPT web conversations.
Three categories of forensic artifacts persist on Windows endpoints after an employee uses a browser-based AI tool and deletes the session. This paper documents what they are, where they live on disk, and what each one proves — with a step-by-step verification guide so any practitioner can confirm the findings on their own machine.
Edge cases, macOS artifact paths, and enterprise MDM blind spots. Follow on LinkedIn or check back.
The research shows what the artifacts contain. An audit shows what's in your environment — deleted conversations, shadow AI accounts, and data already in vendor training pipelines.