A lightweight starting point for a repeatable analysis record. Adapt it to your environment and the evidence you actually have.
01 / Preserve the original
Record where the document came from and keep a fingerprint of the original bytes. This creates a stable reference for later comparison.
Fingerprint the document ↗
02 / Check the actual format
Inspect the header instead of relying only on the extension. ZIP and OLE containers can require more specialised document-analysis tools.
Inspect the container ↗
03 / Prepare the next analysis step
Record what is known and what remains untested. This initial pass does not inspect macros or determine whether active content is safe.
Format extracted indicators ↗
Keep a structured record
SAMPLE Filename and SHA-256 SOURCE Origin and collection time FORMAT Observed signature and structure OBSERVATIONS What was directly observed LIMITATIONS What has not been examined NEXT STEPS Questions for deeper analysis