Common artifacts

An artifact is a trace that an operating system or program leaves as a side effect of normal use: a record of a program being run, a file being opened, a device being connected or a web page being visited. Users rarely know these traces exist, which makes them valuable, but each one answers only specific questions and has known limits. This lesson introduces the artifacts that examiners rely on most, mainly on Windows, with a short look at browsers, phones and cloud services. Interpreting them in depth belongs to examiner-level courses such as CFX and MFX.

Evidence that a program ran

• Prefetch files (C:\Windows\Prefetch, extension .pf) are created by Windows to speed up program start-up. Each records the program's name, how many times it ran and when it last ran (on Windows 8 and later, up to eight recent run times). Prefetch is normally enabled on desktop versions of Windows but is often disabled on servers and can be switched off.
• UserAssist entries in each user's NTUSER.DAT registry hive record programs that user launched through the graphical interface, with a run count and last run time. The program names are stored lightly obscured with ROT13, a simple letter substitution, which tools decode automatically.

Evidence that a file or folder was opened

• LNK files (shortcut files) are created automatically in the user's Recent folder (%APPDATA%\Microsoft\Windows\Recent) when files are opened. A LNK file stores the target's full path and its timestamps at the time, the type of drive and, for many drives, the volume's serial number, which can link a file to a specific USB drive.
• Jump Lists keep, for each application, the files recently opened with it (in the AutomaticDestinations and CustomDestinations folders under Recent). They show which program opened which file.
• ShellBags, stored in the user's NTUSER.DAT and UsrClass.dat hives, record folders the user browsed in Explorer, including folders on removable drives and network shares that no longer exist.

The registry and connected devices

The Windows registry is a database of settings stored in files called hives: SYSTEM, SOFTWARE, SAM and SECURITY in C:\Windows\System32\config, and NTUSER.DAT and UsrClass.dat in each user profile. Among many uses, it records USB storage devices. The key SYSTEM\CurrentControlSet\Enum\USBSTOR lists storage devices that were connected, with vendor, product and, for most devices, a serial number; SYSTEM\MountedDevices links devices to drive letters; and the text log C:\Windows\INF\setupapi.dev.log records when a device was first installed. Together they can show that a particular USB drive was connected to the computer, and when.

Event logs

Windows writes event logs to C:\Windows\System32\winevt\Logs, in files with the extension .evtx. The Security log records, for example, successful logons (event ID 4624), failed logons (4625) and logoffs (4634), when the relevant audit settings are enabled. The System and Application logs record services, errors and installations. Logs have a maximum size and overwrite their oldest entries, so they may cover only days or weeks, and an empty or short log can mean either little activity or deliberate clearing, which itself leaves a recorded event in the Security log.

Web browsers

Browsers keep history, downloads, cookies and cache in their profile folders, mostly in SQLite databases. Chromium-based browsers, such as Chrome and Edge, store history in a database file named History, with tables for visited addresses, individual visits and downloads; Firefox uses places.sqlite. Their timestamps use different formats (Lesson 6.2). Private or incognito windows are designed to leave little or no history on disk, so its absence does not prove that no browsing took place.

Phones and cloud services in brief

On phones, most app data, including many messaging apps, is kept in SQLite databases and settings files inside each app's private storage, together with system logs. Which artifacts can be reached depends heavily on the acquisition level and lock state (Module 4). Cloud storage clients on computers keep local databases and logs of synchronization, which can show that a file was uploaded, downloaded or deleted, even when the file itself is no longer on the device.

Artifacts at a glance

What artifacts do not prove

Artifacts record activity by a user account on a device, not by a named person. If several people share an account or know its password, the artifacts cannot say who was at the keyboard; other evidence, such as logon times, the person's location or camera footage, may help. A missing artifact is equally limited: settings, cleaning tools, log rotation, private browsing or a different program can all explain an absence. The strongest findings rest on several independent artifacts that agree, and the report states what each one shows and does not show (Module 7).

A worked example

An employee is suspected of copying a client list to a USB drive. The examiner finds a USBSTOR entry for a drive with a specific serial number, first connected at 12:44 UTC. A LNK file and a Jump List entry show the client list opened from drive E: at 12:47 UTC, and the LNK file records a volume serial number. The Security log shows the employee's account logged on since 08:30. Each artifact alone is limited; together they support the finding that, at 12:47 UTC, the employee's account opened the client list from a USB drive connected three minutes earlier. Whether the file was copied, and by whom, are separate questions that need further evidence.

Exam focus: Know which artifacts show program execution (Prefetch, UserAssist), file and folder access (LNK files, Jump Lists, ShellBags), USB connections (USBSTOR, MountedDevices, setupapi.dev.log) and logons (Security log event IDs 4624, 4625, 4634), where the main registry hives are, and that browsers store history in SQLite databases. Expect questions on what each artifact proves and does not prove, account versus person, why absence of an artifact is weak evidence, and the value of corroboration.