Understanding Windows Artefacts

Windows artefacts are records created by the operating system, applications, and user interaction. Together, they can support findings about execution, access, persistence, files, devices, and system use.

What you will learn

By the end, you should be able to explain artefact provenance, avoid treating one parser result as proof, and choose corroborating evidence.

What are Windows artefacts?

Core concept

An artefact is data produced as a side effect of system or user activity. Its value depends on what created it, when it updates, how long it persists, and whether the acquisition included the required source files.

ExecutionPersistenceUser activityDevicesApplications

Keep in mind: A parsed record is an interpretation of source data. Retain the source and record the parser version and settings.

01Source artefactThe original file, database, hive, or record being parsed02ParserA tool that converts structures into readable fields03CorroborationIndependent evidence that supports or challenges a finding

Artefact families

Execution and accessRecords associated with programmes, files, and applications

User interactionShell items, Jump Lists, thumbnails, and recent activity

Persistence and configurationScheduled tasks, services, Registry, and compatibility data

Resource and device useSRUM, USB, network, power, and hibernation evidence

Why it matters

Reconstruct execution

Several artefacts may indicate that a programme was present or used.

Understand user activity

Shell and application records can connect accounts with files and locations.

Correlate evidence

Shared paths, identifiers, and timestamps link activity across artefact families.

Test explanations

Independent records help distinguish expected activity from suspicious behaviour.

How artefact analysis works

1. DefineState the activity, user, system, and time range under investigation.
2. LocateIdentify source artefacts and confirm they were acquired completely.
3. ParseUse a recorded tool version and preserve errors, warnings, and raw source data.
4. InterpretApply the artefact's creation, update, timestamp, and retention behaviour.
5. CorroborateCompare independent artefacts before reporting an important finding.

Choose the next step

ScenarioA Jump List references a document path. What can you conclude immediately?

The user definitely opened and read the entire documentThe artefact associates the application context with the document path and should be corroboratedNothing; Windows artefacts have no evidential value

Select an answer to review the reasoning.

Interpret before concluding

1. 1PreserveRetain source artefacts and parser outputs.
2. 2UnderstandKnow what creates and updates the record.
3. 3CorrelateCompare identifiers, paths, users, and time.
4. 4QualifyState limitations and confidence.

Windows-artefact tools in SUSA

Eric Zimmerman suite

EZ Tools in this SUSA section

These guides cover tools listed in the current Eric Zimmerman tool set. Use the suite page for installation and shared dependency guidance.

Independent projects

Other Windows-artefact tools

These tools have separate maintainers, release channels and provenance. Record each tool's own version and source.

Continue learning

• Explore Eric Zimmerman Tools for suite installation and shared requirements.
• Choose a focused guide above according to artefact source, not only the output you hope to find.