Where to Find OpenAI Codex Artifacts for Digital Forensics
Summary
The article maps Codex artifacts under the user’s .codex directory, including prompt and session histories, configuration, model cache, skills, and authentication data, and describes fields useful for reconstructing agent activity.
Key points
- Codex-related files are located in the user’s C:\Users\<username>\.codex\ directory.
- models_cache.json contains the Codex models list; history.jsonl stores user prompts, session IDs, and timestamps.
- config.toml stores configuration, while auth.json may contain API keys and access tokens.
- The skills directory contains built-in and installed skills.
- Session JSONL files can contain user and agent messages, timestamps, images, and token-usage data.
Article Details
- Topic
- Digital forensic artifacts left by the OpenAI Codex AI coding agent