FiveM client & session triage
Resolve the actual client layout and compare session logs, cache, resources, and Windows artifacts cautiously.
Question & scope
A FiveM examination should start with the actual client installation and session rather than a memorized universal folder layout. Record the client version or update channel, the game installation, relevant client data locations, and the disputed server/session window. Use the active client and its configuration to identify paths, documenting how each location was resolved.
Cfx client documentation and diagnostic reporting guidance are useful references for the current product. Preserve relevant client-generated logs before additional launches or troubleshooting change them. Do not assume that every cache file represents a player-installed modification.
What to collect
| Source | Retain and examine |
|---|---|
| Client environment | Installation/data paths, version or channel, and game context. |
| Session records | Relevant client diagnostic logs with timestamps and original locations. |
| Resource context | Available resource or cache observations and associated server/session details. |
| Independent artifacts | Processes, file identity, execution records, and matching filesystem changes. |
Examination workflow
- Identify the running client’s actual installation and relevant data locations rather than scanning one presumed folder.
- Collect logs for the disputed session and preserve original path and time information.
- Read errors and resource context alongside the client version and session conditions.
- Examine unexpected executables or modules through hashes, paths, signatures, and behavior context.
- Correlate leads with independent Windows artifacts and describe what cannot be established from client logs alone.
Interpretation & false positives
Servers can deliver resources that appear in client-side context. Cached or resource-related material is not automatically an independently installed cheat. A crash, failed download, or resource error may reflect an ordinary update or server problem. State which observation supports the suspected distinction.
Client layouts and logging change over time. Avoid publishing an unverified list of supposedly forbidden paths as a universal detection method. A local log can be missing or incomplete, and a process name can be changed. Stronger conclusions connect bytes, paths, timing, and observable behavior.
Worked scenario
A cache directory contains unfamiliar script-related names after a server session. Compare the resource context with that session before classifying the files. If a separate utility is suspected, collect its identity and execution-related evidence instead of treating cached server content as the utility. Preserve uncertainty where server context is unavailable.
Report checklist
- The actual installation and session are recorded.
- Server-delivered resources are considered.
- Crash and cache observations are not verdicts.
- Windows corroboration is tied to the same time window.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.