A lightweight starting point for a repeatable analysis record. Adapt it to your environment and the evidence you actually have.
01 / Identify the sample
Keep the original unchanged. Record its source, collection time and filename. Calculate a SHA-256 fingerprint so later notes refer to the same content.
Calculate a fingerprint ↗
02 / Inspect the structure
Use file signatures and leading bytes to establish a starting hypothesis about format. Record the observed values before adding an interpretation. A header alone is not proof of a valid or malicious executable.
Inspect file headers ↗
03 / Document what is known
Separate observations, interpretations and unanswered questions. Defang any indicators in the shareable report, while retaining the original evidence separately.
Prepare report indicators ↗
Keep a structured record
SAMPLE Filename and SHA-256 SOURCE Origin and collection time FORMAT Observed signature and structure OBSERVATIONS What was directly observed LIMITATIONS What has not been examined NEXT STEPS Questions for deeper analysis