Christopher L. T. Brown

White Papers

White papers, technical notes & gap analyses

Authoritative technical writing that translates deep engineering into clear, defensible ideas. Free to read and download.

White paperDigital Forensics

Ghost Machines on the Macintosh: VM-Concealed Remote Access and Control in Compromised macOS Systems

8 pagesPDF

An examiner's guide to identifying a Macintosh under continued remote control. It explains the ghost machine tradecraft — headless virtual machines installed on compromised hosts, from UNC1945 to Payouts King — what the compromised Macintosh itself records (unified logs, launchd and Background Task Management, TCC, quarantine, remote management and virtualizer traces), where host visibility ends, and how examiners assemble that record into a defensible identification of the concealed remote access.

macOSdigital forensicsghost machinesvirtualizationremote accessDFIR
Download PDF
Technical noteDigital Forensics

Recovering and Reading the Forensic Record of AI Activity

7 pagesPDF

Written for the investigator meeting an AI-activity case. It follows the seven-stage pipeline that AI Extract and the Analysis Workbench implement, from collection to a sealed container, and shows how the sealed evidence becomes chains, gaps, and subjects an examiner can interrogate and defend.

AI forensicsAI ExtractAnalysis Workbenchdigital forensicschain of custody
Download PDF
Technical noteDigital Forensics

Reading the Onion: Tor, the Dark Web, and the Forensic Investigator

4 pagesPDF

Tor conceals who is talking to whom on the wire — but not the fingerprints a browser leaves on its own machine. A short technical note on how Tor and onion services actually work, where their protection genuinely stops, and how investigators convert those limits into admissible evidence.

Tordark webdigital forensicsonion serviceschain of custody
Download PDF
Gap analysisAI Security

State of the Art & Critical Gaps in AI Agent Security

14 pagesPDF

A technical gap analysis of autonomous AI agent security across Windows and macOS — ambient operating-system authority, Model Context Protocol (MCP) tool poisoning, and missing cryptographic provenance in agent delegation — and the architectural changes required to contain agents as untrusted actors.

AI securityagentsMCPprompt injectionWindowsmacOS
Download PDF
White paperDigital Forensics

AI Prompt/Input Activity Evidence Collection in Windows and Macintosh Systems

30 pagesPDF

A practitioner-focused white paper for digital forensic investigators, incident responders, eDiscovery professionals, and DFIR tool developers. It organizes the evidence of AI prompt/input activity on Windows and macOS into ranked artifact categories, ranks each by evidentiary value and volatility, and proposes a concrete forensic collection and reporting tool design ("PromptTrace") detailed enough to guide a proof of concept.

AI forensicsdigital forensicsWindowsmacOSprompt forensicsMCPmemory forensics
Download PDF
White paperDigital Forensics

Forensic Artifacts Left by AI: Tool Capability Needs

8 pagesPDF

A practical white paper for forensic tool developers and DFIR practitioners, mapping the artifacts that local AI applications, browser services, model runtimes, and agentic coding tools leave behind on Windows and macOS — along with the multi-source, confidence-aware tool capabilities required to reconstruct AI activity into defensible evidence.

AI forensicsdigital forensicstool developmentWindowsmacOSagentic AI
Download PDF
Gap analysisOSINT

Navigating the Modern OSINT Landscape

13 pagesPDF

An enterprise advisory report on the fragmented OSINT tooling ecosystem, surfacing gaps in collection coverage, entity resolution, and forensic chain of custody — and outlining a five-tier reference architecture for auditable, high-velocity intelligence collection.

OSINTthreat intelligencedigital forensicsentity resolutionchain of custody
Download PDF