Reference
When you find something on a host, this tells you what it proves. More usefully, it tells you what it does not prove, which is where the expensive mistakes live.
Each entry covers one artifact: the paths it lives at on each Windows version, what you can conclude from it, what you cannot, how to parse it, how long it survives, and what an attacker can do to it.
The pair that matters is proves and does not prove, shown side by side rather than on separate screens. Most references list what an artifact shows and stop there, which is how “Shimcache proves execution” became the most repeated mistake in Windows forensics. It does not. It proves a file existed.
A registry hive recording programs the system has encountered, and one of very few artifacts that stores a hash. When a binary has been deleted, the SHA-1 here is often the only way to identify what it was.
does not proveExecution, despite being widely cited as an execution artifact. Presence is what it records
macOS replaced its text logs with a single binary, compressed, extremely verbose store. It records far more than syslog ever did, and it rolls far faster, which makes it urgent rather than convenient.
does not proveAnything beyond its window, which on a busy Mac is days rather than weeks
The Linux kernel audit subsystem, and the only source on a Linux host that reliably records process execution with arguments. Like PowerShell logging, its value depends entirely on whether somebody configured it first.
membersPaths, parsers, retention, and what this one does not prove.
The Background Activity Moderator throttles background applications, and in doing so keeps a per-user record of executables with a last-execution time. Rarely cleared and rarely checked.
membersPaths, parsers, retention, and what this one does not prove.
Detections, the actions taken on them, and the configuration changes that stopped detections happening. The third of those is the one that matters in a ransomware case.
does not proveThat a detection means the threat was stopped. 1116 without a matching 1117 is a detection with no action
When enabled, Windows records the actual text of every PowerShell block before it runs, after deobfuscation. It is the single highest-value log on a Windows host and it is off by default.
does not proveAnything at all when the policy is off, which is the default. An empty log is a configuration finding, not an absence of activity
Windows writes a .pf file the first time a program runs and updates it on subsequent runs. It is the most direct execution evidence on a workstation, and one of the few artifacts that records how many times something ran.
does not proveWHO ran it. Prefetch carries no user context at all
The commands a user typed, in order, in a plain text file they own and can edit. Enormously useful and never, on its own, evidence of anything.
does not proveWhen. bash writes no timestamps unless HISTTIMEFORMAT is set, so ordering is all you have
The Application Compatibility Cache records executables Windows has evaluated for shimming. It is the single most misread artifact in Windows forensics: an entry means the file was seen, not that it ran.
does not proveEXECUTION. This is the mistake to avoid. On Windows 10 and 11 there is no execution flag at all, and even on Windows 7 the flag was unreliable
The richest execution and network telemetry available on Windows without an EDR, and the one most likely to be missing entirely, because it has to be installed and configured first.
membersPaths, parsers, retention, and what this one does not prove.
The structured log most modern Linux systems actually use. It carries far more than syslog did, and on a default installation it is frequently volatile, which means a reboot takes it.
membersPaths, parsers, retention, and what this one does not prove.
Per-user record of programs launched through the GUI, kept by Explorer to power the Start menu. It is the artifact that answers "which account did this", which Prefetch and Shimcache cannot.
does not proveAnything launched from a console, a script, a service or a scheduled task. This is GUI activity only, so most attacker tooling is absent
Windows keeps a per-application record of the files each program opened, so the taskbar can offer them again. It is file access evidence with the application attached, which is more than most artifacts give you.
membersPaths, parsers, retention, and what this one does not prove.
Windows writes a shortcut when a file is opened, capturing the target's path, size and timestamps at that moment. The shortcut routinely outlives the file, and preserves metadata about a document you no longer have.
membersPaths, parsers, retention, and what this one does not prove.
A deleted file becomes a pair: $R holding the content and $I holding the original path, size and deletion time. In insider cases the $I is often what establishes intent.
membersPaths, parsers, retention, and what this one does not prove.
Explorer remembers the view settings of every folder a user opens, and in doing so keeps a per-user record of folders visited, including folders that no longer exist and volumes no longer attached.
membersPaths, parsers, retention, and what this one does not prove.
Every NTFS file carries two sets of timestamps: $STANDARD_INFORMATION, which is what tools display and what an attacker can set, and $FILE_NAME, which is far harder to forge. Comparing them is how timestomping is caught.
membersPaths, parsers, retention, and what this one does not prove.
NTFS logs every file creation, deletion, rename and data change to a journal. It records what happened to files that are now gone, which is the gap the MFT alone leaves.
membersPaths, parsers, retention, and what this one does not prove.
macOS keeps a per-volume log of filesystem changes so that applications can watch directories. As a side effect it records that a path was created, modified or renamed, often long after the file is gone.
membersPaths, parsers, retention, and what this one does not prove.
Point-in-time snapshots of a volume. They hold earlier versions of files an attacker has since modified or deleted, which sometimes means a copy of the registry from before the intrusion.
membersPaths, parsers, retention, and what this one does not prove.
The macOS equivalent of a Run key and a service in one mechanism. A property list in one of six directories, and which directory it is in tells you what privilege it runs with.
membersPaths, parsers, retention, and what this one does not prove.
The oldest and still the most common autostart location. Trivial to check, trivial for an attacker to use, and worth verifying on every host regardless of how unsophisticated it seems.
membersPaths, parsers, retention, and what this one does not prove.
A scheduled task survives reboot, can run as SYSTEM, and blends into a directory that legitimately holds hundreds of entries. It is among the most common persistence mechanisms in real intrusions.
membersPaths, parsers, retention, and what this one does not prove.
The modern Linux persistence mechanism, and the one that blends in best: a unit file among hundreds of legitimate ones, or a timer that looks like a maintenance job.
membersPaths, parsers, retention, and what this one does not prove.
macOS records which applications have been granted access to the camera, microphone, screen recording, full disk and automation. On a Mac, a consent grant is the closest equivalent to a privilege escalation.
membersPaths, parsers, retention, and what this one does not prove.
A filter, a consumer and a binding together make persistence that touches no autostart key and no task folder, survives reboot, and runs as SYSTEM. It is quiet, and it is missed by anyone checking only the usual places.
membersPaths, parsers, retention, and what this one does not prove.
The control plane record for an AWS account: who called which API, from where, with which credential. It is the single most important artifact in a cloud incident and it has a gap most people discover during one.
membersPaths, parsers, retention, and what this one does not prove.
Every authentication against Microsoft cloud identity, interactive and otherwise. Reading only the interactive ones is why token replay gets missed.
membersPaths, parsers, retention, and what this one does not prove.
Who logged in, from where, and when, spread across a text log and three binary files that most people forget exist.
membersPaths, parsers, retention, and what this one does not prove.
The Security log records every successful and failed authentication with a Logon Type that distinguishes an interactive session from a network share access from RDP. Lateral movement is reconstructed here.
membersPaths, parsers, retention, and what this one does not prove.
Remote Desktop writes to several channels, and no single one tells the whole story. Reading only the Security log is why "we saw no RDP" is said about hosts that were reached over RDP.
membersPaths, parsers, retention, and what this one does not prove.
The three binary login databases. Current sessions, the historical record, and the failed attempts, in three files that are trivially editable by anyone with root.
does not proveAnything that did not create a session. An SSH command executed without a login shell may leave nothing here
Chrome, Edge, Brave and every other Chromium build keep visits, downloads and typed URLs in one SQLite database. It is the artifact that most often establishes how something arrived on a host.
membersPaths, parsers, retention, and what this one does not prove.
Windows keeps roughly thirty to sixty days of per-application resource accounting, including bytes sent and received per process per user. For sizing an exfiltration it is often the only host-based source.
membersPaths, parsers, retention, and what this one does not prove.
Host-level connection records, off by default, and the rule changes that accompany them. The rule additions are worth more than the connections.
does not proveAnything about connections if text logging was never turned on, which is the default
One row per network connection, with duration and byte counts in both directions. It survives encryption, which is why it answers questions a proxy log cannot.
membersPaths, parsers, retention, and what this one does not prove.
