What is Provenance and How Might Digital Forensics Impact Your Next Case?

On June 22, 2024, CBS aired a 60 Minutes segment called "The Looting of Cambodia" regarding systematic and perpetual theft of Cambodia's cultural treasures and antiquities from religious sites across the country. Described as the “greatest art heist” in history, it spanned thirty years from the 1970s to the 90s, during which Cambodia's treasures were stolen and sold to wealthy art collectors and museums. For the past decade, the Cambodian government has been striving to recover these artifacts.

A breakthrough came in 2011 when Sotheby's placed a 500-pound Sandstone Warrior for auction on behalf of an individual seller. The piece was recognized as originating from a temple in Cambodia and the seller became of particular interest to law enforcement. Investigators confirmed the statue's origin, or provenance, leading Sotheby's to halt the sale. 

Investigators seized a computer, revealing images of the Sotheby's statue and additional artifacts and emails detailing how the antiquities from Cambodia were obtained, reassembled, and repaired. Emails exchanges described precisely how they were excavated and needed to be cleaned.

At this point, you might be wondering what any of this has to do with digital forensics and the answer is "provenance". Provenance is the story behind an object—its origins, its journey, and its guardianship. In the art world, provenance reveals who once owned a painting or sculpture, where it was acquired (i.e. gallery, auction house, or private collection) and how it was preserved, from a dusty box in an attic to a climate-controlled museum. This lineage establishes authenticity, builds trust, and ultimately defines value. Provenance can be stored in digital format.

Digital forensics applies the same principle, creating a meticulous record of where data came from, accurate dating and receipt, how it has been handled, and who has had access to it. By preserving provenance in digital form, investigators ensure credibility, integrity, and confidence in the evidence; transforming raw information into a story that can stand the test of scrutiny and investigation into provenance.

At Capsicum Group, we have been tasked with investigating and searching for documentation to provide the necessary provenance for clients who possess antiquities or art and need proof of authenticity. In one such case, the owner of Peruvian art valued in the millions of dollars wanted to sell her treasures, but the auction houses required provenance. Lacking this documentation, she sought assistance from Capsicum Group to contact the prior owner and, if permitted, conduct a digital forensic analysis of the owner's computer for any provenance documentation.

After acquiring a full physical image of the computer, we undertook analysis to search for data related to the art in both the allocated and unallocated space of the computer’s hard drive. The search proved fruitful, uncovering documentation about most of the twenty-eight (28) pieces of art requiring provenance. Capsicum Group identified and mapped the art to documentation as well as data found on the computer, providing context about the data, including file name, file location, timestamps, and number of pages. The data was extracted and produced for the client, enabling her to meet the auction houses’ requirements and move forward with the sale.

In another case, Capsicum was hired to preserve and investigate data related to an art collector concerning the resale of the Kilia Stargazer Idol. A New York couple, who were philanthropists and antiquities collectors, purchased the piece in 1993 for $1.5 million. Christie’s auction house handled their sale in 2017 where the idol fetched $14.5 million. The Turkish government filed a complaint seeking to stop the sale of the statue, claiming it was looted out of Turkey in the 1960s. The New York couple sought documentation supporting the idol's provenance from their computer systems related to this piece of art. While Capsicum successfully found and produced the requisite proof of provenance, the court ultimately ruled that the necessary provenance rested with the art's public display in the United States for over 34 years, and that Turkey had waited too long to bring a claim for art on the open market (“public provenance”).

Capsicum Group helps clients establish provenance with precision and authority. Through the use of advanced digital forensics, we systematically uncover, analyze, and document the full history and ownership of assets like the artifacts mentioned here. Capsicum experts leverage cutting-edge digital forensic tools to examine everything from cloud repositories to storage devices, revealing the critical details that define authenticity and credibility. Our comprehensive presentation of findings simplifies the process and provides a clear, defensible narrative of provenance, presented in a way that clients, auction houses, and legal authorities can trust and easily verify.