Forensic Artifact

Definitions

1. A piece of digital evidence left by system or user activity, such as logs, registry keys, browser history, prefetch data, or memory remnants. Investigators use forensic artifacts to build timelines and prove what actions occurred on a system.

   In plain English: A trace left behind on a system that can help investigators understand what happened.

   Example: "The deleted file was gone, but a forensic artifact in the shell history proved it had been executed."

Related Terms

• Chain of Custody
• Computer Forensics
• Digital Forensics
• Digital Chain of Custody
• Disk Forensics
• Email Header Analysis
• Forensic Analysis
• Forensic Image
• Forensic Workstation
• Image Forensics
• Intrusion Analysis
• Memory Dump
• Packet Analysis
• Payload Analysis
• Protocol Analysis