Artifacts
Understand what records can establish, where context is lost, and what to compare next.
Ask what the record actually records
An artifact is a record or residual structure that can help reconstruct activity. Its meaning depends on the producing application, operating-system version, configuration, collection method, and parser. Start with the producer's semantics before using a friendly label in a report.
- Windows Security log clear records
An original interpretation guide for Event 1102, subject identity, and corroboration.
- UserAssist
Windows user-profile activity records; examine scope and alternative explanations.
- Registry Hives
Registry collection and interpretation entry point, including the need for relevant companion files.
- Windows Defender Logs
Security product records whose visibility depends on product settings and collection.
- Windows Prefetch
Execution-related artifacts require version and configuration context.
- Shellbags
Folder-related records require cautious interpretation of interaction and identity.
Storage, memory, and applications
- Slack Space
Residual bytes have allocation and context limits; a fragment is not a complete history.
- SSD TRIM
Storage management is a competing explanation for unavailable deleted content.
- Hibernation and browsing evidence
Existing blog discussion of hiberfil.sys. Availability and interpretation depend on the system state and Windows version.
- Reading the Notepad tab cache
Existing original application research. Establish the Notepad build and save/session settings before generalizing.
Record the conditions for an absence claim
List the searched paths, accounts, time range, acquisition gaps, retention settings, and parser version. State whether a record was absent in the collected material or expected to be generated at all. Those are different claims. Compare application records to independent device, server, or cloud records where available.
For generated media and related AI application records, the layered synthetic-evidence evaluation method offers a contextual reading path. Its source-history approach complements artifact examination; it does not establish a particular file's origin.
Detailed references in this section
- Windows
What a Windows Security log clear record establishesInterpret Event 1102 without turning an account record into a claim about intent.
- Linux / systemd
Read a Linux journal gap in its boot and storage contextCompare journal storage, boot identity, filtering, and collection before interpreting missing Linux events.
- Windows
Investigate Windows forwarding gaps across the collection pathDistinguish event generation, subscription selection, delivery, storage, and search visibility.
- Windows / NTFS
Interpret NTFS change records without inventing a complete historyUse journal identifiers, reason flags, file references, and independent records to bound a change claim.
- Windows / macOS / Linux
Preserve browser SQLite databases with their transaction contextSeparate a consistent logical database from a preserved source collection, and keep WAL-related limitations visible.
- Cloud / AWS
Bound cloud audit findings by event coverage and credential identityUse AWS CloudTrail as a concrete model for account, region, event category, retention, and attribution limits.
- Containers / Kubernetes
Separate container output, node records, and Kubernetes audit eventsReconstruct a workload with stable identifiers and the actual logging architecture rather than one command’s output.
- iOS / iPadOS / Android
State what a mobile backup or logical export leaves outside scopeDistinguish device content, backup eligibility, synchronized services, and the particular collection product.
- Windows
Hiberfil.sys, pagefile, and live memory: three different browsing questionsInterpret browser-related remnants with their power-state, collection, time, and attribution limits.
- Windows 11 / Notepad
Notepad tab state and saved files answer different recovery questionsConnect recovered session content to its source without assuming it was saved, transmitted, or written by a particular person.
- Windows
Compare UserAssist, BAM, DAM, Prefetch, and SRUM by the question they answerSeparate shell activity, moderation records, launch-related traces, and resource usage before combining them into execution evidence.
- Windows / Microsoft Defender Antivirus
Read Microsoft Defender logs as product observations with collection limitsSeparate detection, action, failure, configuration, and retained evidence before assessing an incident.
- Windows; verify examined build and parser support
Registry hives: NTUSER.DAT, SYSTEM, SOFTWARE, and transaction contextDistinguish profile and machine context, preserve companion files, and avoid turning a key timestamp into a user-action history.
- Windows Security auditing and Microsoft Entra examples
Login history, logon sessions, and the limits of user attributionDistinguish an account’s authentication records from a session, resource use, and evidence identifying a human operator.