Forensic Artifacts Left by the Claude Code AI Agent
Summary
The article identifies Claude Code artifacts on Windows, including configuration, plugin, and project-history files. It describes how timestamps, session details, agent responses, and tool-use records may help investigators reconstruct activity.
Key points
- Claude Code configuration files are located under C:\Users\<username>\.claude\; settings.json stores configuration, history.jsonl records user prompts and session details, and policy-limits.json stores policies and restrictions.
- Plugin records include installed_plugins.json and known_marketplaces.json in the .claude\plugins folder.
- Project histories are stored as JSONL files under .claude\projects\<project>\ and include agent responses as well as user history.
- Useful project-history fields include timestamps, sessionId, cwd, the model used, response text, and tool_use entries indicating an agent tool call.
Article Details
- Topic
- Forensic artifacts and investigation of Claude Code activity