I am reading about the incident response. I cannot able to understand exactly the terms artifact and evidence. When i searched in google so many resources are using these terms generally. How can i find out standard definitions for these two terms? and what is the difference between them?
Artifact: A piece of data that may or may not be relevant to the investigation / response. Examples include registry keys, files, time stamps, and event logs. You can see many defined in the ForensicArtifacts project on github.
Evidence: A piece of data (artifact) that is relevant to your investigation because it supports or refutes a hypothesis.
With our incident response software, we talk about collecting artifacts from remote hosts and analyzing them to determine if they are evidence.
Artifact: Something observed in a scientific investigation or experiment that is not naturally present but occurs as a result of the preparative or investigative procedure.
If you pull a hard drive the data is evidence.
If someone had to take ownership of a file to break into some encryption then that person will show as last updated by. That is an artifact.