Record the file

BeforeYou have the file in an isolated folder, and you have not opened it.

Actions

• Write down where it came fromSender, URL, host or ticket. Add the time in UTC.
• Compute the SHA-256 hashRun shasum -a 256 file and paste the result into the note.
• Identify the type from contentRun file file. Record what it says, not the extension.

Done when

The note has origin, time, SHA-256 and file type, under Evidence.