Minecraft instances, logs & loaded mods
Identify the actual instance and correlate launcher, loader, crash, and mod records for the session under review.
Question & scope
Minecraft players can use multiple launchers, accounts, loaders, and instance directories. Identify the configured game directory and the selected profile before examining a mods folder. An empty default location says little about an instance stored elsewhere. Record the Minecraft, loader, and mod versions relevant to the disputed session.
Fabric documents game logs such as latest.log and archived logs, while crash reports contain crash context rather than the complete normal session log. Preserve the actual files before restarting the game, because later activity can change which session a latest log describes.
What to collect
| Source | Retain and examine |
|---|---|
| Launcher profile | Selected instance, game directory, versions, and relevant launch configuration. |
| Session logs | Current and relevant archived game logs with original paths and times. |
| Crash context | Associated report, exception information, and session association. |
| Mod inventory | Collected JARs, configuration, metadata, and exact content hashes. |
Examination workflow
- Ask the launcher to identify its actual instance folder, and record the selected profile.
- Collect the session logs and relevant archives before launching another session.
- Read loader and mod-list context with version information; distinguish discovery, loading, and runtime behavior.
- Match collected JARs with the instance and exact official release variants, then examine relevant entrypoints and mixins.
- Correlate session times with Windows artifacts when the question involves a separate utility or removed file.
Interpretation & false positives
A mod list is not a complete behavioral transcript. A failed startup can discover a mod without reaching a playable session, and configuration can alter its behavior. A log line containing a suggestive class name or mixin target is not sufficient to prove a cheat. Legitimate mods commonly transform game classes.
Logs may contain server addresses, account identifiers, chat, or tokens. Share only the relevant redacted portion publicly while keeping the original evidence appropriately. Local logs can be incomplete or modified, so report their provenance and corroborate important claims.
Worked scenario
A crash report names a combat-related class, but the matching log shows startup failed before the game session began. Examine the JAR to establish capability separately, and avoid claiming that capability was used during the match from the crash alone. If a later successful session is relevant, collect its own records.
Report checklist
- The actual instance and loader variant are identified.
- Logs are tied to the correct session.
- Discovery, loading, capability, and use are separated.
- Public excerpts redact unrelated player data.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.