Evidence of execution

Evidence of execution is the set of traces that let an investigator state that a program ran on a system, and ideally when, how often and under which account. It is one of the most common questions in an intrusion case: an attacker's tool sitting on disk is one thing, proof that it was launched is another.

No single artifact answers the question on its own, and each one has a different strength. Prefetch records the executable name, a run count and recent run times. BAM / DAM and UserAssist tie a launch to a specific user. Other sources are weaker: Amcache and ShimCache often only prove that a binary was present or seen by the compatibility engine, especially on Windows 10 and later, so treating them as proof of a run is a classic mistake.

Good practice is to corroborate. Combine several independent sources, check their timestamps against the $STANDARD_INFORMATION vs $FILE_NAME times of the binary itself, and look for supporting traces such as event logs, SRUM usage records or files the program created. When artifacts disagree, understand what each one actually records before drawing a conclusion. Absence of evidence also matters: Prefetch can be disabled, and several sources are capped or rotated.