Device events show the removable medium was attached, but not necessarily which confidential file was accessed and copied during the user session.

Deletion often leaves recoverable metadata or journal entries for a period, although retention, overwrites, and cleanup affect what survives.

A current directory view omits many prior rename and deletion operations and is not sufficient to reconstruct historical file activity.

Sandboxing is useful but it executes the specimen, so it does not meet the stated static-only constraint.

Execution changes the analysis environment and can trigger dangerous behavior rather than preserving a static assessment.

Running unknown code on production infrastructure violates the no-execution requirement and can introduce compromise.

Standard library function names do not uniquely identify the operator behind the binary.

Malicious and benign software can use the same APIs; context and additional artifacts are necessary.

Static imports alone are insufficient to establish runtime actions or a successfully created autorun entry.

Compressed and encrypted resources can be unpacked at runtime and do not inherently prevent execution.

Entropy alone cannot identify malware family, intended impact, or whether the code encrypts victim documents.

Section entropy and code-signing status are different properties and need independent evaluation.

Unused code, test data, or deception can contain those values without corresponding runtime actions.

An imprecise broad block can disrupt benign services and does not follow from one embedded string.

Removing the specimen can destroy the original evidence and prevent further expert examination.

Executing unknown software on a trusted endpoint risks compromise and uncontrolled access to corporate resources.

Weakening controls on production endpoints increases risk and lacks the isolation required for safe malware observation.

A critical identity server must not be used as a detonation target because malware may disrupt or steal sensitive authentication data.

Dynamic coverage is limited by execution time, environmental dependencies, and possible anti-analysis techniques.

Visibility depends on instrumentation and encrypted-channel handling, and some actions may not execute at all.

Execution does not automatically modify the original sample bytes, so a hash change is not an expected proof of harmlessness.

Package inventory cannot reconstruct transient injected memory regions and active process mappings.

Disk forensics is valuable for file-backed malware, but purely in-memory or unpacked injected code can be absent from the preserved filesystem image.

DNS intelligence may reveal infrastructure relationships but cannot expose injected code that exists only inside the compromised process memory.

A larger but stable store is not automatically the most time-sensitive evidence. Running laptop memory and session state may disappear irreversibly at power loss.

Data volume does not determine how quickly an artifact will vanish or its relevance to the current incident.

Screenshots can support context but do not preserve volatile host processes or recoverable memory artifacts.

A partial observation can still be important when its limitations are accurately stated and linked to other evidence.

Encryption conceals content from the passive sensor but does not establish that the underlying activity was benign.

Encrypted flow records cannot reveal file content without additional endpoint, proxy, or decrypted evidence.

A hash-hit summary omits other artifacts and cannot support independent investigation of alternative hypotheses.

Running malware can change files and compromise the examination environment, defeating preservation goals.

Writable shared originals undermine integrity and make it hard to distinguish discovered data from analyst changes.