AI Chat Logs: From Prompt to Proof
By Reid Wittliff.
Every prompt an employee types into ChatGPT, Claude, Copilot or Gemini creates a record. Those records are electronically stored information, they are discoverable under the ordinary rules, and courts are already ordering their production. This article covers how AI chat logs become evidence, how litigators obtain them, what digital forensics recovers after a user deletes a conversation, and where courts currently stand on privilege.
Four days after Karl Sundstrom was fired from his job at CX360, Inc., an AI bot named Otter tried to join an online company meeting under Sundstrom’s name. Investigators later learned that Sundstrom had used Otter to record and transcribe confidential internal meetings for months, had forwarded himself no fewer than 218 emails containing proprietary company information, and had walked out the door with sensitive customer data, pricing information, and manufacturing processes. West Technology Group, LLC v. Sundstrom, No. 3:24-cv-00178-KAD (D. Conn. 2024).
This case reflects a growing litigation trend. AI activity is often at the heart of a case, and litigators who fail to pursue, obtain, and use it leave critical proof on the table.
The Power of AI Chat Logs as Evidence
Employees and other key players use AI tools like ChatGPT, Claude, Microsoft Copilot, and Google Gemini across the full spectrum of business activities. They craft communications, summarize key contracts, vet business plans with AI thought partners, and prepare for sensitive meetings. Because the interface feels like a private conversation, many users assume these exchanges are confidential, never to see the light of day.
For example, in one criminal case, a Florida student typed, “What happens if a human has a put (sic) in a black garbage bag and thrown in a dumpster” several days before his two roommates went missing. When ChatGPT responded that it sounded dangerous, the student typed, “how would they find out.” Investigators found these chats and secured a murder indictment against the student.
How Lawyers Obtain AI Evidence
The most direct path is a traditional request for production to the opposing party. The request should be broad enough to capture prompts, responses, session histories, files shared or uploaded to the AI, the skills and instructions provided to or used by the AI, and all outputs generated by the AI.
Litigators should also include AI language in litigation hold notices. This step is critical because many organizations have no policy requiring preservation of AI interactions, and if employees delete conversation histories or other AI information that should have been retained, spoliation sanctions may result.
Courts are making it clear that AI information should be treated as ordinary electronically stored information. In the copyright litigation against OpenAI, the court ordered production of 20 million de-identified consumer ChatGPT logs and weighed AI prompt and output records under the usual rules of relevance and proportionality. In re OpenAI, Inc., Copyright Infringement Litig., No. 25-MD-3143 (SHS) (OTW), 2025 WL 3136726 (S.D.N.Y. Nov. 7, 2025); In re OpenAI, Inc., Copyright Infringement Litig., 800 F. Supp. 3d 602 (S.D.N.Y. 2025).
Subpoenaing the AI Provider
If AI evidence is not available directly from the AI user, litigants may subpoena the AI providers. Whether a provider has responsive records may depend on its retention practices, the user’s settings, and which product version was involved. Enterprise deployments, such as Microsoft Copilot inside a corporate Office 365 environment, often generate far richer logs kept for compliance. Those logs may be invisible to the employees who created them, but they are likely discoverable. ArcherHall’s team regularly handles collections from Office 365 environments of exactly this kind.
Downstream Artifacts
AI content also surfaces downstream. A user who copies AI analysis into an email, a contract, or a code repository creates discoverable evidence in those systems even if the original conversation is long gone. This is the same principle behind unexpected sources of evidence generally: the copy often outlives the original. And some platforms like Anthropic’s Claude are now using digital watermarks to identify content that was created using AI, a practice Anthropic announced in August 2026. Smart discovery strategies follow both the upstream conversation and the downstream artifacts.
AI Chat Log Forensics: Why Deletion Is Not Erasure
Even when ordinary document collection produces nothing, AI evidence may survive on the devices where AI was used. This is where digital forensics becomes essential.
Where AI chat log artifacts are typically recovered:
- Web browsers. Users who reach ChatGPT or other AI tools through a web browser leave artifacts in browser IndexedDB storage, local caches, and session records. These can persist long after the user deletes a conversation history or logs out.
- Windows desktop applications. The ChatGPT desktop application for Windows leaves recoverable cache files, metadata, and registry artifacts even after a user tries to delete them.
- Mobile devices. On mobile devices, AI data may persist in app sandboxes, SQLite databases, and cloud backups the user never thought to address. Cell phone forensics reaches data that is invisible through the app itself.
A qualified forensic team can often find and recover AI artifacts that standard eDiscovery workflows miss, including evidence a user tried to destroy.
What Litigators Need to Start Doing Now
For litigators, the threshold question in any case involving technology, trade secrets, employment disputes, fraud, or intellectual property is: what AI tools were the custodians using, and what did those interactions look like?
Four steps follow from that question:
- Ask early. That inquiry should come as soon as the client anticipates litigation, and not as an afterthought once a discovery dispute has surfaced.
- Identify the tools. Once the AI tools are identified, litigators should work with their clients and their IT providers to identify all potentially relevant AI evidence.
- Preserve the evidence. Then, steps need to be taken to preserve that evidence.
- Bring in forensics. Here again, digital forensics experts can be helpful as they can identify and extract AI artifacts so they are available in the discovery phase of the case.
Organizations with no AI governance policy, no retention controls, and no forensic preservation capability take on litigation risk with every conversation their employees have with these tools. The records exist. Courts are ordering their production. The question is whether a company will preserve and collect them in time, or whether the first hard look at AI evidence comes when opposing counsel is asking for it.
Are AI Chats Privileged?
Another emerging issue with AI evidence that counsel should be aware of is privilege. Some courts hold that a user’s AI chats are neither attorney-client privileged nor work product. In United States v. Heppner, for example, the court held that a criminal defendant’s chats with Claude were not privileged, because he shared them with a third party whose privacy policy allowed disclosure. United States v. Heppner, 820 F. Supp. 3d 292 (S.D.N.Y. 2026).
Other courts have reached the opposite result on different facts. In Warner v. Gilbarco, Inc., the court denied a motion to compel discovery of a self-represented plaintiff’s ChatGPT use, finding it was protected work product. Warner v. Gilbarco, Inc., 820 F. Supp. 3d 629 (E.D. Mich. 2026).
Frequently Asked Questions About AI Chat Logs as Evidence
Are ChatGPT conversations discoverable?
Yes. Courts treat AI prompts and outputs as ordinary electronically stored information, subject to the usual rules of relevance and proportionality. In the OpenAI copyright litigation, the court ordered production of 20 million de-identified consumer ChatGPT logs.
Can ChatGPT logs be used against you in court?
Yes, in both civil and criminal matters. In one criminal case, a Florida student’s ChatGPT prompts about disposing of a body contributed to a murder indictment. In employment and trade secret disputes, AI transcription tools and chat histories have been central to the proof.
Can deleted AI chat logs be recovered?
Often, yes. Deleting a conversation in the app does not erase the artifacts it left behind. Browser IndexedDB storage, local caches, desktop application cache files, Windows registry artifacts, mobile app sandboxes, SQLite databases and cloud backups can all retain recoverable traces after a user deletes a conversation or logs out.
Should a litigation hold cover AI tools?
Yes. Most organizations have no policy requiring preservation of AI interactions. If a litigation hold notice does not name AI tools specifically, employees may delete conversation histories that should have been retained, which can expose the organization to spoliation sanctions.
Can you subpoena an AI provider for chat logs?
Yes, though whether the provider holds responsive records depends on its retention practices, the user’s settings and which product version was involved. Enterprise deployments such as Microsoft Copilot inside a corporate Office 365 environment often generate far richer compliance logs than consumer accounts, and those logs may be invisible to the employees who created them.
How ArcherHall Can Help
ArcherHall’s digital forensics team works with litigators and corporate counsel on a nationwide basis to identify, preserve, and collect AI evidence. This includes browser artifacts, mobile device data, AI logs, and deleted conversation remnants. If you are working a case where AI use may be relevant, or building a litigation hold process that must account for AI evidence, contact us to discuss how we can help.
