File triage checklist

Record first, analyse second.

Write down origin, time and hash before you open anything. You cannot recover that context later.

Before you open the file

• Where did it come from? Sender, URL, host or ticket.
• When did it arrive? Use UTC.
• SHA-256 hash.
• File type from content, not from the extension.
• Who else has it? Other recipients or hosts.

Where it goes

Keep the checklist answers at the top of the note, under Evidence. Interpretation comes later.

Next step: What hash reputation can and cannot tell you.