Artifacts are text-only. Some files simulate logs and packet summaries.

Tips:
- Keep an investigator notebook.
- Validate timestamps and timezones.
- Identify IOCs (IPs/domains/hashes/usernames) and the timeline.