An OpenAI and NBER study found that nearly 80% of ChatGPT usage is centered on practical guidance, information seeking, and writing, with information seeking functioning much like web search. As search behavior shifts from keyword-based search to conversational AI, ChatGPT is becoming increasingly relevant in digital investigations. Because these interactions develop through natural-language dialogue, conversation histories can reveal not just what was searched, but how the user’s intent evolved, making them a valuable source of investigative insight.
This article focuses on ChatGPT as a leading generative AI application and addresses practical questions in a Q&A format. This article is based on findings extracted with MD-NEXT v2.2.13 from devices running Android 14, using Full Filesystem with MD-PLUG and Android Live extraction methods and analyzed via MD-RED v4.0.10.
Table of Contents
- App Data Storage Structure and Extraction
- Artifact Analysis by User Behavior
- 5. Can I find conversation records created without logging in?
- 6. Are all conversations synchronized after login?
- 7. What range of data is stored when entering each chatroom?
- 8. If a chatroom is deleted, can I still recover the data?
- 9. If the user logs out from the device, does the data disappear?
- 10. Can I find conversations from ‘Temporary Chat’?
App Data Storage Structure and Extraction
This section examines how ChatGPT app data is stored on Android device and available information for extraction.
1. Can I extract data through mobile forensics even though it is stored on the server?
Yes. ChatGPT conversation records can be analysis through mobile forensic examination. When chat history is synchronized, the corresponding data is stored on the device, making the synchronized data recoverable through mobile forensic analysis.
2. Do the available analysis results vary depending on the extraction method?
Yes. The available artifacts vary by the extraction method. The available results can be summarized as follows:
| Extraction Method | Available Information |
|---|---|
| Backup |
|
| Full Filesystem |
|
3. How is the data stored?
The data is stored in DB format under /data/com.openai.chatgpt/databases.
/var/mobile/Applications/com.openai.chat/Library/Application Support/conversations-v3{device UUID}.4. Can user-generated images or attached files be identified?
User-generated images are retained as cache files, which are stored at /data/com.openai.chatgpt/cache/coil3_disk_cache.
The filenames of attached files, including .pdf, .xml, and .doc, can be identified; however, the actual files cannot be analyzed.
Artifact Analysis by User Behavior
This section examines the data that can be identified based on ChatGPT usage scenarios.
5. Can I find conversation records created without logging in?
Yes. Conversation records will be stored on the device even without logging in. Because conversation records are stored in an SQLite database, chats conducted while not logged in are available for analysis.
6. Are all conversations synchronized after login?
No. Logging in automatically synchronizes only the 20 most recent conversations, and the contents are not synchronized unless each one is opened individually. To synchronize older chats, you must scroll through the chat list to trigger additional synchronization.
7. What range of data is stored when entering each chatroom?
When you enter a chatroom, the full text content is synchronized at once, and the entire conversation is recorded in the database. No additional scrolling is required after entering the chatroom to synchronize the data.
For image files, if the image has not been loaded on the device, the original file is not stored and therefore cannot be analyzed. If the image has been loaded properly, a cache file (coil3_disk_cache) is created, allowing the image to be analyzed.
8. If a chatroom is deleted, can I still recover the data?
Yes, but only under limited conditions. When a chatroom is deleted, the related database records are marked as deleted. If those deleted records have not yet been cleaned up, the data may still be identified. However, once the deleted records have been cleaned up, data cannot be recovered.
9. If the user logs out from the device, does the data disappear?
Yes. When the user logs out, all conversation data (.db) stored on the device is deleted.
10. Can I find conversations from ‘Temporary Chat’?
No. Temporary chat conversations cannot be examined because they are not stored locally on the device and are not synchronized.
