Could an artefact have been created automatically?¶

title: Could an artefact have been created automatically? subtitle: Yes. Applications and operating systems create messages, locations, files, notifications and logs without a person performing each individual action. slug: could-an-artefact-have-been-created-automatically series: mobile-extraction-and-reader-reports section: evidential-limits-corroboration-and-supervision card_type: question_card content_type: core-operational risk_level: high-risk pathway_order: 55 section_order: 5 status: draft owner: IF Digital last_updated: '2026-07-25' version: '0.1' review_gate: pending review_mode: ai-assisted review_timebox_mins: 60 qa_gate: pending qa_count: 0 pipeline_ref: PIPELINE_PRG_001 pipeline_version: '1.1' public_safe: true video_ready: true word_count: 476 estimated_read_time_seconds: 197 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - mobile evidence - automation - background process - application artefact - human action sources: - title: SWGDE Best Practices for Mobile Device Forensic Analysis url: https://www.swgde.org/documents/published-complete-listing/20-f-005-swgde-best-practices-for-mobile-device-forensic-analysis/ - title: 'NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics' url: https://csrc.nist.gov/pubs/sp/800/101/r1/final - title: 'Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)' url: https://www.gov.uk/government/publications/forensic-science-activities-interpretation-and-communication-fsr-gui-0004

Could an artefact have been created automatically?¶

Yes. Applications and operating systems create messages, locations, files, notifications and logs without a person performing each individual action.

Script¶

Mobile devices create large amounts of data automatically.

An artefact can be genuine and accurately parsed without representing a deliberate human action.

Applications synchronise in the background.

Operating systems create logs, indexes, thumbnails and notifications.

Cloud services download files and contacts.

Messaging applications generate delivery and read-status updates.

Maps and weather services request locations.

Photo applications create albums and previews.

Security products scan links and files.

Automation may also be configured by a user.

A scheduled message, shortcut, workflow, rule or third-party application can create an event later without the user touching the phone at that moment.

The user may still have caused the automation earlier.

Start with application behaviour.

What normally causes the record to be created?

Is it generated on user input, on receipt of data from a server, on application launch, on synchronisation or on a schedule?

Does the source contain a flag for manual, automated, system or background activity?

Was the artefact created by the application, operating system or cloud provider?

Then look for local interaction.

Is there a typed draft, button event, application-use record, foreground session or local file associated with the action?

Did the artefact appear while the device was locked or unattended?

Does the sequence show a background process waking and completing a task?

Automation does not always remove human responsibility.

A person may configure a rule to forward messages.

They may schedule a post.

They may authorise a payment workflow.

An application may send a standard message after they change a record.

The relevant human action may have occurred earlier than the artefact timestamp.

Identify the trigger.

What event caused the automated process to run?

Who configured it?

Which account or application had authority?

Could the workflow have operated incorrectly or been abused?

Provider or application logs may hold the answer.

Be careful with recommendations and generated content.

A notification showing a place, person or product may have been selected by an algorithm.

A cached image may have been prefetched.

A search suggestion may not have been submitted.

The presence of automatically presented content does not prove interest or knowledge.

The common mistake is:

“The artefact exists at this time, so the user created it at this time.”

The system may have created it in response to an earlier action or no direct action at all.

Another mistake is:

“It was automated, so no person is relevant.”

Human responsibility may sit in configuration, authorisation or the trigger event.

A careful conclusion might say:

“The application created this message automatically when the account status changed. Audit records link the status change to this user session thirty seconds earlier.”

Or:

“The operating system generated the thumbnail during background media indexing; no evidence of deliberate opening was identified.”

An artefact records a software process.

Before describing human behaviour, establish whether the process was manual, automatic or triggered by an earlier action.

Ask what process normally creates the artefact and whether the record distinguishes manual action from automation.

Related questions¶

• What does an application artefact actually show?
• What does a timestamp prove about when a person acted?
• Does data on the phone prove the user knew it was there?

Source notes¶

• SWGDE Best Practices for Mobile Device Forensic Analysis
• NIST SP 800-101 Rev. 1: Guidelines on Mobile Device Forensics
• Forensic Science Regulator: Interpretation and Communication (FSR-GUI-0004)