What is the term for evidence of changes made to a hard disk?

The term for evidence of changes made to a hard disk is artifacts. In digital forensics, artifacts refer to data remnants that can be analyzed to provide insights into the user activity and changes that have occurred on a digital device, such as a hard disk. These artifacts can include file metadata, temporary files, or even logs that document how and when files were modified or deleted.

Artifacts serve as crucial evidence during investigations, as they help establish a timeline of events and user interactions with the data on the hard disk. Understanding these artifacts is essential for forensic analysts in uncovering the circumstances surrounding the changes that were made, providing valuable information for legal proceedings or cybersecurity incidents.

Other terms like footprints, impressions, and markings tend to reference different concepts or types of evidence in other contexts. For example, ‘footprints’ might indicate traces left by user activity that can suggest specific patterns or actions taken, while 'impressions' could refer to more physical evidence or tangible marks left behind. 'Markings' might be more generally associated with identifiable marks on a document or surface rather than digital evidence. Therefore, artifacts specifically capture the evidence of changes made within the context of digital storage devices.