An SCT holds the log ID (SHA-256 of the log's public key), a timestamp in milliseconds, extensions and a signature over the certificate data (RFC 6962 §3.2). Embedded SCTs live in the X.509 extension 1.3.6.1.4.1.11129.2.4.2 as a TLS-encoded list; the TLS extension signed_certificate_timestamp (18) delivers them in the handshake instead, which lets servers add SCTs without reissuing.
Clients count SCTs against their CT policy using their own log lists: if a log is later distrusted, SCTs issued by it before the distrust date may still count. A certificate without enough valid SCTs fails in Chrome with NET::ERR_CERTIFICATE_TRANSPARENCY_REQUIRED.
The SCT decoder shows which logs signed a certificate's SCTs and when.