Erased photos, surviving faces: On-device AI residue as a new class of digital evidence in Samsung Gallery

Abstract

Traditional digital forensics analyzes artifacts that directly record user actions, such as logs and application databases. As on-device AI becomes common, however, AI residue — data derived from user content, such as facial feature vectors — can also serve as digital evidence. Using the people-tag feature of Samsung Gallery as a case study, this paper reverse-engineers the on-device face-clustering pipeline (static analysis with Ghidra, dynamic analysis with Frida) and quantitatively evaluates the forensic value and persistence of the resulting residue, with four contributions. (i) We document the pipeline from face detection to GCN clustering, including five decision thresholds and the extraction-failure boundary (|pose|≥ 38°), and release an open-source tool that reproduces it; tool- and device-generated vectors match at mean cosine 0.9512(N = 2, 440). (ii) With external reference images, the tool identifies registered persons at TPR 95.62% and detects permanently deleted persons at 95.67%. (iii) To our knowledge, this is the first quantification of how long deleted vectors persist in face_data: block reuse is deterministic (smallest-unreferenced-first, 100% predicted-vs-observed match), giving survival of T₉₀ = 83 and T₅₀ = 385 newly registered faces. (iv) Eight differential-residue rules distinguish normal use from intentional concealment (F1 = 1.0), and person data is redundantly stored in the system-protected media.db, auto-restoring after user-level app-data deletion. These findings establish AI residue as a distinct class of digital evidence.