An artefact, for these purposes, is any machine-generated record produced as a side-effect of ordinary use — not the user's document or message, but the system's record that the document or message existed, was opened, was moved, or was deleted. Artefacts are hard to fabricate because they are numerous, they are written by the operating system rather than by the user, and they corroborate or contradict each other in ways that expose after-the-fact tampering.
The artefacts examiners rely on most
| Artefact | What it records | Where it lives |
|---|---|---|
| Prefetch (.pf) | Application launches, with first- and last-run timestamps and executable path. | Windows C:\Windows\Prefetch. |
| Shellbags | Folders opened in Explorer, including on removable and now-disconnected media. | Windows registry (NTUSER.DAT / UsrClass.dat). |
| LNK / Jump Lists | Files and folders opened, including originals on external volumes. | Recent items and AutomaticDestinations. |
| USBSTOR / MountedDevices | USB devices attached, first / last connect and volume serials. | Windows registry hives; setupapi.dev.log. |
| $MFT / $UsnJrnl | File creation, rename, deletion and metadata changes. | NTFS volume metadata. |
| Browser history / cache | Pages visited, search terms, downloads, session restores. | Browser profile directories. |
| Unified Log (macOS) / Event Log (Windows) | System, security and application events with sub-second timestamps. | OS log stores. |
| Message-database rowids | Insertion order of messages independent of the visible timestamp. | SQLite message databases (WhatsApp, iMessage, Signal). |
| Cloud-sync client logs | Files uploaded / downloaded, account identifiers, sync errors. | OneDrive / Drive / Dropbox client directories. |
Why they carry weight
- They record activity even when the user has cleared the visible record — deleting a message from an app does not clear the SQLite journal, and deleting a file does not clear its LNK.
- They corroborate each other: an insertion sequence in a message database that contradicts the displayed timestamp is a signature of manipulation.
- They tie activity to a specific device and account with a precision screenshots cannot match — a WhatsApp message carries a message ID; a screenshot carries none.
- They are written by the system, not the user, which makes selective fabrication difficult without touching adjacent artefacts that will not match.
The single most persuasive line in a good forensic report is the one that reads: 'These three independent artefacts, written by different subsystems, agree.' That is very hard to fabricate — and very hard to explain away.
How artefacts should appear in a report
- 01Name the artefact. In plain English before any technical term — 'the Windows Prefetch file, which records when a program was launched'.
- 02Describe where it comes from. Which subsystem writes it, and under what conditions.
- 03Explain what it does and does not prove. A prefetch entry proves the program was launched; it does not prove who launched it.
- 04Cross-reference to other artefacts. Show the corroborating and contradicting records the tribunal is being asked to weigh.
- 05State the residual uncertainty. The range of alternative explanations consistent with the artefact, honestly.
Where artefact evidence is decided
The report either reads as an audit of the machine's own record-keeping — dispassionate, cross-referenced, and honest about limits — or it reads as advocacy dressed up in file paths. Tribunals distinguish between them quickly. The first is given weight; the second is not. Instructing solicitors can steer for the first by asking the examiner, at scoping, to identify the artefacts they intend to rely on and why.
Frequently asked questions
Individual artefacts can be edited, but faking a set of them consistently — across independent subsystems, without leaving traces in adjacent records — is extremely difficult and, in our experience, almost always visible on examination.
Most do not on the device itself; some survive on cloud backups, on paired devices, and in tenant audit logs. That is one reason preservation should reach beyond the primary device.
The report is admissible; whether it is given weight depends on whether the working images and the artefact extracts are available to the tribunal and to the opposing side. Retain the images.
Enough to make the reasoning followable, no more. A short glossary and a well-chosen diagram often does more work than a longer narrative.
The equivalents do — Unified Log on macOS, syslog and journald on Linux, plus file-system metadata. The names change, the evidential logic does not.