Illustrative image.
Start with identity
Record the artifact’s original name, path, size, and source. When your tools support it, retain a SHA-256 hash alongside the collection time and the person or process responsible for the collection. A screenshot alone rarely supplies all of that context.
Separate observation from conclusion
An extracted URL, API name, or command string is a lead. It does not by itself show that the program performed the action. Keep static inspection, runtime observations, and analyst interpretation distinguishable.
Keep collection limits visible
Record missing inputs, permissions, unsupported formats, interrupted sessions, and other collection gaps. A partial trace is still useful when readers can see what was and was not collected.
Make the handoff readable
Include a concise question, the relevant findings, source artifacts or approved references, and the limitations that affect interpretation. Let the next reviewer trace a statement back to its supporting material.
Use the right environment
Controlled runtime investigation belongs in an authorized analysis environment. Follow your organization’s incident-response process when deciding what to collect, contain, or escalate.