Operating System and Application Artifacts
Where behaviour is recorded
Windows offers the richest artifact set. Registry hives - SAM, SYSTEM, SOFTWARE, SECURITY, and per-user NTUSER.DAT and UsrClass.dat - record configuration, devices, and user activity. Execution artifacts include Prefetch (run counts and last-run times, though it may be disabled, notably on servers), Amcache (installation and first-run metadata), ShimCache/AppCompatCache (existence; execution interpretation varies by version), and SRUM (per-application resource and network usage). User activity surfaces in LNK files, Jump Lists, Shellbags, and recent-documents lists. System and application EVTX logs, the WMI repository, and Volume Shadow Copies round out the picture.
Linux artifacts include /var/log (syslog, auth.log), wtmp/btmp/lastlog, systemd journal, shell history files, cron and systemd timers, and /proc for live state. macOS contributes unified logs, property lists, FSEvents, quarantine events, and Spotlight metadata.
Traps
Confusing which artifact proves what. ShimCache presence does not always prove execution; Amcache is not ShimCache. Prefetch may be absent on servers or after cleanup. LNK files persist after their targets are deleted, so their existence is not proof the target still exists. Event log IDs are frequently misremembered - verify before citing.
Worked example: to prove a program ran, build a hierarchy: Prefetch last-run time and run count, Amcache first-execution record, SRUM usage entries, and event log 4688 where process auditing is enabled. Two independent artifacts make a far stronger finding than one.