Publications

Peer-reviewed forensics and security research.

My recent work focuses on mobile forensics, AI companion app evidentiary value, and practical tooling for investigators.

Peer-reviewed publications

2026 • Forensic Science International: Digital Investigation

With or without logs: Memory forensic reconstruction of Model Context Protocol (MCP) activity in agentic LLM systems

A. Satter, M. Salmon, L. Muhanna, T. T. Spinosa, T. Gharaibeh, I. Baggili

Reconstructs Model Context Protocol activity from memory in agentic LLM systems, showing how tool-use behaviour and system interactions remain recoverable even when no logs were kept.

FSI: Digital Investigation, vol. 57, art. 302130

Read paper

2026 • DFRWS EU

Ex Machina: A forensic evaluation of AI companion applications and their evidentiary value

K. J. Comeaux, T. T. Spinosa, A. Ghosn, I. Baggili

First cross-application forensic study of AI companion platforms totalling over 25M downloads, with artifact-based user profiling and an assessment of evidentiary value.

FSI: Digital Investigation, vol. 56, art. 302050

Read paper

2025 • ARES / WSDF

Money on My Mind: Forensic Investigation of Venmo Payment App

T. Spinosa, A. Onik, J. Rovira, I. Baggili

First-author study of vulnerabilities in Venmo through network traffic inspection and logical acquisition, including MFA bypass pathways and API session-token abuse for transaction recovery. Released as the PyMent tool.

Int. Conf. on Availability, Reliability and Security, pp. 60–77

Read paper

2024 • DFRWS USA

Hit and run: Forensic vehicle event reconstruction through driver-based cloud data from Progressive's Snapshot application

A. R. Onik, T. T. Spinosa, A. M. Asad, I. Baggili

Extracts and validates Progressive Snapshot artifacts, demonstrating accurate speed and location recording and revealing driving behaviour not exposed in the mobile interface. Released as the PyShot tool.

FSI: Digital Investigation, vol. 49, art. 301762

Read paper

Full citation record on Google Scholar.