Reference
Artifact library
A structured reference to the traces that operating systems, browsers and applications leave behind. Every entry gives the exact location, the fields that matter, how its timestamps are encoded, a step-by-step examination workflow, the interpretation pitfalls and the primary sources behind each statement.
No artifact matches these filters.
Windows 24
Execution, file access, USB devices, accounts and event logs on Windows systems.
- CoreFile system
$MFT (NTFS Master File Table)
NTFS Master File Table: FILE records for every file holding $STANDARD_INFORMATION and $FILE_NAME times, names, parents and data runs.
- CoreProgram execution
Amcache.hve
Registry-format hive of application inventory data: file paths, SHA-1 values, PE metadata and installed-program records.
- CoreProgram execution
AppCompatCache (Shimcache)
AppCompatCache value in the SYSTEM hive listing file paths and modification times seen by the compatibility subsystem; not proof of execution.
- CoreFile and folder access
Jump Lists
Per-application AutomaticDestinations (OLE compound file with DestList) and CustomDestinations files that list recent or frequent items as LNK data.
- CoreFile and folder access
LNK shortcut files
Shell Link files that record a target's path, volume serial, share name, MAC times, size and machine identifier; found in Recent folders and Jump Lists.
- CoreProgram execution
Prefetch files
Per-executable SCCA trace files holding run count, up to eight last run times and referenced files; MAM-compressed on Windows 10 and 11.
- CoreDeleted files
Recycle Bin ($I / $R files)
Per-user $Recycle.Bin folders where each deleted item has a $I metadata file (original path, size, deletion time) and a $R data file.
- CoreFile and folder access
ShellBags (BagMRU / Bags)
BagMRU and Bags keys that keep Explorer view settings per folder, preserving folder paths and shell-item times even after a folder is deleted.
- CoreExternal devices
USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)
USBSTOR, USB and MountedDevices keys plus setupapi.dev.log, which together identify attached storage devices, serials and volume mappings.
- CoreEvent logging
Windows XML Event Log (EVTX)
EVTX files: 64 KiB chunks of binary-XML event records, each with a record identifier and a FILETIME written time, stored per log channel.
- IntermediateFile system
$UsnJrnl:$J (USN change journal)
NTFS change journal: sparse $J stream of USN_RECORD entries with file reference, parent, name, reason flags and a FILETIME per change.
- IntermediateProgram execution
BAM / DAM (Background and Desktop Activity Moderator)
BAM and DAM keys in the SYSTEM hive that map user SIDs to executable device paths, each with an execution FILETIME.
- IntermediateFile and folder access
RecentDocs registry key
Per-user MRU key listing files and folders recently opened through Explorer, grouped by extension and ordered by MRUListEx.
- IntermediateUser activity
RunMRU and TypedPaths
Per-user registry lists of commands typed into the Run dialog (RunMRU) and paths typed into the Explorer address bar (TypedPaths).
- IntermediatePersistence
Scheduled tasks
Task definitions as XML files under System32\Tasks, mirrored in TaskCache registry keys, plus legacy .job files and task creation events.
- IntermediatePersistence
Services registry key
Per-service and per-driver configuration keys in the SYSTEM hive: image path, start type, service type, logon account and ServiceDll.
- IntermediateResource usage
SRUM (SRUDB.dat)
ESE database of per-application and per-user resource use: CPU cycles, disk I/O, network bytes and connectivity, keyed through an ID map table.
- IntermediateFile and folder access
Thumbcache databases
Explorer thumbnail cache files: CMMM cache files keyed by ThumbnailCacheId plus an IMMM index, storing picture thumbnails per size.
- IntermediateProgram execution
UserAssist
Per-user registry counters for programs and shortcuts launched through Explorer: ROT-13 names, run counts and last execution times.
- IntermediateFile system
Volume Shadow Copies
Copy-on-write snapshots kept in System Volume Information that preserve earlier states of files, registry hives and logs on a volume.
- IntermediateUser activity
Windows Timeline (ActivitiesCache.db)
SQLite activity history database behind Windows Timeline, recording app, file and URL activities with JSON payloads and epoch times.
- IntermediateUser activity
WordWheelQuery (search terms)
Per-user registry key that stores search terms entered in Windows search as UTF-16LE strings ordered by an MRU list.
- IntermediateFile origin
Zone.Identifier alternate data stream (Mark of the Web)
NTFS alternate data stream with a [ZoneTransfer] ZoneId value that Windows adds to files from the Internet or Restricted sites zones.
- AdvancedFile system
$LogFile (NTFS metadata transaction journal)
NTFS metadata transaction journal used to restore consistency after a failure; restart and record pages whose LSNs link to MFT entries.
File systems 4
On-disk structures that record files, names, sizes and time stamps.
- IntermediateFile system timestamps
exFAT File directory entry times
exFAT File entries store local create, modify and access timestamps with 10 ms increments and a per-timestamp UTC offset in 15-minute steps.
- IntermediateFile system timestamps
FAT32 directory entry times
32-byte FAT directory entries hold create time with 10 ms detail, write time at 2-second resolution and an access date only, all in local time.
- AdvancedFile system timestamps
ext4 inode timestamps
ext4 inodes keep atime, ctime, mtime, dtime and crtime; extra fields add nanoseconds and epoch bits that extend the range to 2446.
- AdvancedFile system timestamps
NTFS $STANDARD_INFORMATION vs $FILE_NAME
Each NTFS MFT entry holds two sets of four FILETIMEs, in $SI and in $FILE_NAME; comparing them is a standard check for timestomping.
Browsers 9
History, downloads, cookies, sessions and cache in Chromium and Firefox profiles.
- CoreWeb history and downloads
Chromium History database
SQLite store of visited URLs, individual visits with transition types, downloads and omnibox search terms in Chrome, Edge and other Chromium browsers.
- CoreWeb history and downloads
Firefox places.sqlite (history and bookmarks)
Firefox history store: moz_places URLs, moz_historyvisits visits with visit types and PRTime timestamps, bookmarks, typed input and download annotations.
- CoreWeb history and downloads
Safari History.db
Safari history on macOS: history_items URLs and history_visits with titles, redirect links and visit times in Mac absolute time (seconds since 2001).
- IntermediateCookies
Chromium Cookies database
Chromium cookie store: host, name, path, partition key, creation, last access, last update and expiry times, flags and the source of the last write.
- IntermediateWeb history and downloads
Chromium Favicons database
Chromium favicon cache mapping page URLs to icon URLs and PNG bitmaps, with last-updated and last-requested times useful to corroborate History.
- IntermediateSaved credential metadata
Chromium Login Data (metadata)
Metadata of credentials saved by Chromium: site, form fields, user name, creation, last use, last fill, password change and sharing details.
- IntermediateForm and autofill data
Chromium Web Data (autofill)
Chromium autofill store: form field names and typed values with first and last use, plus saved address and card metadata in Web Data.
- IntermediateCookies
Firefox cookies.sqlite
Firefox cookie store moz_cookies: host, name, path, origin attributes, flags, expiry in ms and creation, last access and update times in µs.
- IntermediateForm and autofill data
Firefox formhistory.sqlite
Firefox store of values typed into web forms and the search bar: field name, value, use count and first and last use in microseconds since 1970.
Android 8
System and app databases that record use, communication and connectivity on Android.
- CoreCalls
Call log (calllog.db)
Android call history in the contacts provider: number, start time in ms, duration, call type 1–7, phone account and feature flags.
- CoreContacts
Contacts provider (contacts2.db)
Android contacts database: raw contacts per account, aggregated contacts, typed data rows and a 30-day log of deleted contacts.
- CoreMessaging
SMS/MMS database (mmssms.db)
Android Telephony provider store for SMS and MMS: addresses, bodies, box/type codes, read flags, threads and MMS part files.
- IntermediateMedia
Google Photos app databases (gphotos*.db)
Google Photos local index: on-device and cloud media rows, capture times, offsets, coordinates, backup folders and app trash.
- IntermediateInstalled apps
Package manager settings (packages.xml)
System packages.xml: installed package names, code paths, installer and ft/it/ut time attributes; may be Android Binary XML from Android 12.
- IntermediateNetwork
Saved Wi-Fi networks (WifiConfigStore.xml)
Android Wi-Fi config store: saved network profiles with SSID, security key type, credentials and vendor-specific timestamps.
- IntermediateApp usage
Usage stats (usagestats)
UsageStatsService files: per-interval app aggregates and event logs such as ACTIVITY_RESUMED, screen and keyguard transitions.
- AdvancedAccounts
Account manager databases (accounts_ce.db / accounts_de.db)
AccountManagerService stores: account names and types, auth tokens in CE storage, and a 64-row debug log of account actions in DE storage.
iOS 9
System databases and property lists that record use, communication and location on iPhone.
- CoreBackups
Backup property lists (Info.plist, Manifest.plist, Status.plist)
Backup root plists recording device identity, iOS version, backup date, encryption state and installed apps, plus the on-device backup settings plist.
- CoreCalls
Call history (CallHistory.storedata)
iOS Core Data call store: ZCALLRECORD rows for cellular, FaceTime and CallKit app calls with Cocoa start time, duration and direction.
- CoreContacts
Contacts database (AddressBook.sqlitedb)
iOS contacts store: ABPerson names and dates, ABMultiValue phone/email/address values, ABStore source, plus a separate images database.
- CoreMessaging
Messages database (sms.db)
iOS Messages store for SMS, MMS and iMessage: message, handle, chat and attachment tables with Apple-epoch dates and read/delivery times.
- IntermediateBackups
Computer backup file index (Manifest.db)
Finder/iTunes backup index: Files table mapping hashed fileIDs to domain and relativePath, with per-file metadata plists.
- IntermediateNetwork
Network data usage (DataUsage.sqlite)
iOS DataUsage.sqlite: per-process Wi-Fi and cellular byte counters with first-seen and usage-entry Cocoa timestamps.
- IntermediateMedia
Photos library database (Photos.sqlite)
iOS Photos.sqlite asset records: file names, created/added/modified/trashed dates, location, saved asset type, trash state and faces.
- AdvancedPattern of life
Biome streams (SEGB files)
Biome SEGB stream files on iOS 15+: per-stream records with Cocoa timestamps and protobuf payloads; format v2 from iOS 17.
- AdvancedPattern of life
CoreDuet knowledge store (knowledgeC.db)
knowledgeC.db ZOBJECT streams with start/end times: app usage, lock and backlight state, now playing, plugged-in and battery events.
Messaging and apps 5
Third-party application stores: messages, contacts, attachments and their time encodings.
- CoreMessaging
WhatsApp for Android messages (msgstore.db)
WhatsApp Android message store: chats, JIDs, messages with ms timestamps, media paths, locations and call_log, in legacy and modern schemas.
- CoreMessaging
WhatsApp for iOS messages (ChatStorage.sqlite)
WhatsApp iOS Core Data store: ZWAMESSAGE rows with Cocoa dates, ZWACHATSESSION chats, ZWAMEDIAITEM paths, plus ContactsV2 and call stores.
- IntermediateContacts
WhatsApp for Android contacts (wa.db)
WhatsApp Android contact store: wa_contacts JIDs, names, numbers, profile wa_name, status text and status time, plus group creator settings.
- AdvancedMessaging
Signal for Android database (signal.db)
Signal Android signal.db: SQLCipher-encrypted store with message, thread, recipient and attachment tables; key sealed via Android Keystore.
- AdvancedMessaging
Telegram for Android local cache (cache4.db)
Telegram Android cache4.db: dialogs, messages with serialized TL blobs and Unix-second dates, users, chats, secret chats and contacts.
macOS 6
Unified logs, launch items, quarantine records and other macOS traces.
- CorePersistence
Launch agents and launch daemons
launchd property lists that start programs at boot, login or on triggers; the main macOS persistence locations and the keys that define them.
- CoreDownloads
QuarantineEventsV2 database
Per-user Launch Services quarantine log: downloading agent, time, data and origin URLs and quarantine type for files received from the network.
- IntermediateApplication usage
KnowledgeC.db on macOS
CoreDuet knowledge store on macOS: streams such as /app/inFocus and /display/isBacklit with start and end times in Mac absolute time.
- AdvancedFolder metadata
.DS_Store files
Finder per-folder metadata store: buddy-allocated B-tree of records keyed by file name, holding view settings, icon positions, comments and dates.
- AdvancedSystem logs
Apple Unified Logging (tracev3)
macOS 10.12+ binary log store: tracev3 files in /var/db/diagnostics with strings in /var/db/uuidtext, read with log show or a parser.
- AdvancedFile system activity
FSEvents (.fseventsd)
Per-volume fseventsd log of paths with event IDs and change flags (created, removed, renamed, modified); records carry no timestamps of their own.
Linux 4
Authentication logs, the systemd journal, shell history and persistence on Linux.
- CoreAuthentication logs
auth.log and secure
Text syslog files collecting auth and authpriv messages such as sshd, sudo and PAM events: auth.log on Debian and Ubuntu, secure on Red Hat-style systems.
- CoreCommand history
Shell history (bash and zsh)
Per-user text files of interactive shell commands; bash adds #epoch lines when HISTTIMEFORMAT is set, zsh stores start time and duration with EXTENDED_HISTORY.
- CoreLogon records
wtmp, btmp and lastlog
Binary login accounting: wtmp logins, logouts and reboots, btmp failed attempts, and lastlog last login per UID, each with known 32-bit time limits.
- IntermediateSystem logs
systemd journal
Binary journald log files: structured entries with trusted fields, boot IDs, realtime and monotonic microsecond timestamps and sequence numbers.
Documents and media 3
Metadata embedded in office documents, PDFs and images.
- CoreImage metadata
JPEG EXIF date, offset and GPS tags
Exif data in a JPEG APP1 segment: DateTimeOriginal and related times, OffsetTime* UTC offsets, sub-seconds, camera identity and GPS IFD position and UTC time.
- CoreDocument metadata
OOXML core.xml and app.xml
Office Open XML property parts: creator, last modified by, revision and W3CDTF dates in core.xml; application, template, company and total edit time in app.xml.
- IntermediateDocument metadata
PDF Info dictionary and XMP metadata
PDF metadata in two places: the trailer Info dictionary (D: dates) and the catalog's XMP stream (ISO 8601 dates, document and instance IDs).