What is a digital artifact?
Definition
A digital artifact is a single piece of data left behind by using a device or app, such as a log entry, a browser history record or a file timestamp, that investigators can read to work out what happened.
- Category
- Security
- Also called
- digital artefact, forensic artifact
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: nvlpubs.nist.gov, csrc.nist.gov, ic3.gov
Last verified against the official page:
NIST's report on digital investigation techniques (NIST IR 8354) describes a digital artifact as a singular unit of interpretable data that can be extracted from a data source and used to answer questions in a forensic investigation. NIST also notes that every interaction with a digital device leaves a trail, and that the trail is made up of artifacts created during the device's routine operation.
What artifacts look like
You never create them on purpose. They are a side effect of normal use. Typical examples are the history and cache in a web browser, entries in a system or app log, the time a file was created or last changed, saved messages, and metadata attached to photos. One artifact on its own may mean little. Several together can show who did what, and when.
Where the term is used
The term comes mainly from digital forensics and incident response, where specialists examine a phone or computer after a crime or a security incident. Artifacts are the evidence they build their findings from. NIST's glossary also uses the broader word 'artifact' for a piece of evidence or a work product such as source code, so the meaning shifts a little depending on the field.
Why it matters to an ordinary person
It works in both directions. Artifacts are how investigators can tell what a hacker did on a hacked account or laptop. They are also why deleting something does not always remove every trace of it: the file may be gone, but a log entry or thumbnail can remain.
Digital artifact vs. digital evidence
Digital evidence is the bigger idea: information stored or transmitted in digital form that can be used to prove something. An artifact is one building block of that evidence.
How to protect yourself
- 1
Keep records if something goes wrong
If you think an account or device has been compromised, do not wipe it straight away. Screenshots, emails and the account's security log can help the platform or the police later.
- 2
Know that deleting is not the same as erasing
Before selling or giving away a phone or laptop, use the built-in factory reset and sign out of your accounts, rather than only deleting files by hand.
- 3
Check what photos and files reveal
Photos and documents can carry metadata such as time and location. Check your phone's settings for sharing location in photos before posting them.
- 4
Report cybercrime to the right place
If you are a victim of an online crime, you can file a report with the FBI at ic3.gov in the US. Elsewhere, use your national cybercrime reporting service.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is an example of a digital artifact?
A browser history entry, a log of when someone signed in to an account, a file's last-modified time, or the metadata inside a photo. Each is a small piece of data created as a side effect of normal use.
What is the difference between a digital artifact and digital evidence?
Digital evidence is any information stored or transmitted in digital form that can prove something. A digital artifact is one unit of data that investigators extract and use as part of that evidence.
Can digital artifacts be deleted?
Some can, but others survive in logs, caches or backups. Deleting a file by hand does not always remove every artifact it created.
Sources
Something wrong or out of date? Tell us and we'll re-check it.