I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i find out standard definitions for these two terms? and what is the difference between them?
Artifact: A piece of data that may or may not be relevant to the investigation / response. Examples include registry keys, files, time stamps, and event logs. You can see many defined in the ForensicArtifacts project on github.
Evidence: A piece of data (artifact) that is relevant to your investigation because it supports or refutes a hypothesis.
With our incident response software, we talk about collecting artifacts from remote hosts and analyzing them to determine if they are evidence.
Artifact: Something observed in a scientific investigation or experiment that is not naturally present but occurs as a result of the preparative or investigative procedure.
If you pull a hard drive the data is evidence.
If someone had to take ownership of a file to break into some encryption then that person will show as last updated by. That is an artifact.
Artifacts would be something supporting such as an SOP or guidelines explaining the process to be followed.
Evidence would be something that proves the process is being followed.