Reference
When you find something on a host, this tells you what it proves. More usefully, it tells you what it does not prove, which is where the expensive mistakes live.
Each entry covers one artifact: the paths it lives at on each Windows version, what you can conclude from it, what you cannot, how to parse it, how long it survives, and what an attacker can do to it.
The pair that matters is proves and does not prove, shown side by side rather than on separate screens. Most references list what an artifact shows and stop there, which is how “Shimcache proves execution” became the most repeated mistake in Windows forensics. It does not. It proves a file existed.
A registry hive recording programs the system has encountered, and one of very few artifacts that stores a hash. When a binary has been deleted, the SHA-1 here is often the only way to identify what it was.
does not proveExecution, despite being widely cited as an execution artifact — presence is what it records
Windows writes a .pf file the first time a program runs and updates it on subsequent runs. It is the most direct execution evidence on a workstation, and one of the few artifacts that records how many times something ran.
does not proveWHO ran it — Prefetch carries no user context at all
The Application Compatibility Cache records executables Windows has evaluated for shimming. It is the single most misread artifact in Windows forensics: an entry means the file was seen, not that it ran.
does not proveEXECUTION. This is the mistake to avoid. On Windows 10 and 11 there is no execution flag at all, and even on Windows 7 the flag was unreliable
Per-user record of programs launched through the GUI, kept by Explorer to power the Start menu. It is the artifact that answers "which account did this", which Prefetch and Shimcache cannot.
does not proveAnything launched from a console, a script, a service or a scheduled task — this is GUI activity only, so most attacker tooling is absent
