Can we trust what looks real? A teaching case on AI-generated digital evidence and organizational decision-making

This teaching case places students in the role of a forensic examiner advising an organization that has received visually convincing digital evidence during a project-delivery dispute. The submitted files include an email screenshot, a PDF approval document, a scanned signature image, a Word file, and a ZIP archive. Each item appears plausible, but the metadata, timestamps, and provenance records raise different levels of concern. The case is designed for postgraduate, advanced undergraduate, and professional courses in digital forensics, cyber security, information-systems governance, AI risk management, IT audit, and technology-enabled investigations. It can be taught either as a discussion-based governance case using supplied metadata extracts or as a lab-supported forensic exercise using common evidence-analysis tools. The central learning objective is to help learners distinguish file integrity from file authenticity: a matching hash may prove that a file has not changed since hashing, but it does not prove that the file is genuine or from the claimed source. Learners must classify the evidence as reliable, suspicious, likely manipulated, or unacceptable, and then advise management on whether action can be taken. The case also supports discussion on AI-use disclosure, source-system verification, document-management audit trails, digital signatures, evidence-submission procedures, and organizational decision-making under evidential uncertainty.