Understanding Windows Artefacts

Windows artefacts are records created by the operating system, applications, and user interaction. Together, they can support findings about execution, access, persistence, files, devices, and system use.

What you will learn

By the end, you should be able to collect useful sources, follow a document path across records, explain what their times mean, and write a finding with clear limits.

What are Windows artefacts?

Core concept

An artefact is data produced as a side effect of system or user activity. Its value depends on what created it, when it updates, how long it persists, and whether the acquisition included the required source files.

ExecutionPersistenceUser activityDevicesApplications

Keep in mind: A parsed record is an interpretation of source data. Retain the source and record the parser version and settings.

01Source artefactThe original file, database, hive, or record being parsed02ParserA tool that converts structures into readable fields03CorroborationIndependent evidence that supports or challenges a finding

Artefact families

Execution and accessRecords associated with programmes, files, and applications

User interactionShell items, Jump Lists, thumbnails, and recent activity

Persistence and configurationScheduled tasks, services, Registry, and compatibility data

Resource and device useSRUM, USB, network, power, and hibernation evidence

Why it matters

Reconstruct execution

Several artefacts may indicate that a programme was present or used.

Understand user activity

Shell and application records can connect accounts with files and locations.

Correlate evidence

Shared paths, identifiers, and timestamps link activity across artefact families.

Test explanations

Independent records help distinguish expected activity from suspicious behaviour.

How artefact analysis works

1. DefineState the activity, user, system, and time range under investigation.
2. LocateIdentify source artefacts and confirm they were acquired completely.
3. ParseUse a recorded tool version and preserve errors, warnings, and raw source data.
4. InterpretApply the artefact's creation, update, timestamp, and retention behaviour.
5. CorroborateCompare independent artefacts before reporting an important finding.

Practice scenario

Help the next analyst trace release-plan.txt. Choose where to save the records, compare full file paths, and build a finding from what the records show. Follow one task at a time. If a choice does not fit the evidence, the exercise explains why and lets you try again.

CASE SUSA-WA027 | WS-07 | 27 SEPTEMBER 2026

Trace the release plan

The help desk worked on Avery's PC. Check Windows records for release-plan.txt, match the paths and leave a note.

Browser practice with fictional records. No Windows files are read or changed.

1. 1Collect
2. 2Find clues
3. 3Leave a note

Step 1 of 3

Collect the training files

Choose the export folder, then click Collect training files.

Avery's recent files

Document paths saved in Avery's profile.

Ready to copy

Windows Prefetch

Program runs and recorded file lists.

Ready to copy

Verified image
WS-07Separate case copy
SUSA-WA027

Save the exported records in

The mounted imageX:\WS-07The separate case folderE:\Cases\SUSA-WA027\sources

Start here: collect both groups with one click.

Optional: try the same steps with real Windows records

Finish the browser exercise first. For this extra practice, use your course's Windows training image, FTK Imager and EZ Tools. Use the user and filename from the image's case sheet; its records will differ from the browser examples.

1. Collect the files. Open the verified image copy in FTK Imager. Export the user's complete AppData\Roaming\Microsoft\Windows\Recent folder, including its subfolders, and C:\Windows\Prefetch. Save them on separate case storage under sources\Recent and sources\Prefetch. Record the image, original paths, user profile and time zone. Hash the exported files, keep them unchanged, and copy the folders to working\Recent and working\Prefetch. Check that those copies match.

2. Read the records. From the folder containing JLECmd and PECmd, run the commands below on the working copies. Replace the case paths with yours and use fresh output folders. Check your installed tools' -h help, and save their versions, commands, outputs and errors.

   .\JLECmd.exe -d 'E:\Cases\SUSA-WA027\working\Recent' --csv 'E:\Cases\SUSA-WA027\parsed\JumpLists'
   .\PECmd.exe -d 'E:\Cases\SUSA-WA027\working\Prefetch' --csv 'E:\Cases\SUSA-WA027\parsed\Prefetch'
   

3. Save a short finding. Search the outputs for the case filename and compare the full paths. For Prefetch, check the resource list as well as the program summary. Keep each time's meaning and use the same time zone. Write what the records show, what they cannot show, and one next check. Keep the raw files with the results. A missing record does not prove the activity never happened.

Want to make your own training trail?

On a disposable Windows VM, save a harmless release-plan.txt in a new folder in Documents. Open it from File Explorer in Notepad, then close it. Record the user, VM, time and time zone. Use your approved lab collector for the same Recent and Prefetch paths. Windows settings and app versions affect which records appear; record any gaps. Keep your case outside the VM before resetting it.

The commands follow the authors' JLECmd and PECmd documentation.

Keep the finding traceable

Interpret before concluding

1. 1PreserveRetain source artefacts and parser outputs.
2. 2UnderstandKnow what creates and updates the record.
3. 3CorrelateCompare identifiers, paths, users, and time.
4. 4QualifyState limitations and confidence.

Windows artefact tools in SUSA

Eric Zimmerman suite

EZ Tools in this SUSA section

These guides cover tools listed in the current Eric Zimmerman tool set. Use the suite page for installation and shared dependency guidance.

Independent projects

Other Windows artefact tools

These tools have separate maintainers, release channels and provenance. Record each tool's own version and source.

Continue learning

• Explore Eric Zimmerman Tools for suite installation and shared requirements.
• Choose a focused guide above according to artefact source, not only the output you hope to find.