Filesystem, memory, network and timeline evidence
Match the artifact to the question
Filesystem metadata, operating-system logs, registry-like stores, application records, memory and network observations can support different parts of an investigation. A filename or timestamp alone does not prove a person intentionally executed a program. Correlate relevant identifiers and independent sources. File allocation, deleted-directory entries and unallocated space have different meanings, and encryption or storage cleanup may limit recovery. One disk from a striped/protected array may not contain a complete independently readable filesystem.
Interpret host artifacts in their version
Windows execution-related artifacts and event logs depend on operating-system version, configuration, retention and collection. A Prefetch record can support a particular execution-related inference under its model but is not an infallible log of every program run on every server. Linux authentication events may be recorded in distribution-specific files or a journal according to logging configuration. The source IP in an authentication event is an observed network peer, not automatically the original human actor behind proxies or intermediate hosts.
Understand memory and network coverage
Memory acquisition can retain relevant processes, mappings and transient material not present in a disk image, but collection itself changes state and not every key or session is recoverable. A packet capture describes the monitored point, filter, capture length, losses and encryption conditions. It does not guarantee that every network byte everywhere was captured or that protected payload can be reconstructed. Flow summaries and logs provide different metadata and may still be valuable even when payload is unavailable.
Build a defensible timeline
Normalize or explicitly preserve time zones, clock offsets and timestamp semantics before ordering events. File creation, modification, access and metadata-change times are different observations and can be changed by legitimate tools, copying or malicious activity. A sequence in one clock domain may differ from another until offsets are considered. Static analysis inspects a sample without deliberately executing it, while dynamic analysis observes a controlled execution; neither removes every analysis-environment risk. Report the sample, tool/version, method and limits. These written scenarios perform no sample execution, capture or private-log access and do not promise a universal legal conclusion or complete forensic reconstruction.