Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Order of volatility
The expensive mistake in the first hour is spending it on a source that will still be there tomorrow while one that rolls hourly quietly empties.
Memory, if the host is still running and you are permitted.
The change journal, which on a busy volume covers hours.
Event logs, 20MB by default and under a day on a domain controller.
Everything on disk, which is still there next week.
Data was collected on this host and sent out.
Collect first, these expire. The NTFS change journal is what records the archive that was built and then deleted, and it rolls by size. On a busy volume that window is hours, not days.
SRUM byte counts alone. SRUM tells you how much a process sent, never where, pairing it with network or proxy logs is what turns a volume into a destination.
if you find nothing
Staging archives are routinely built and deleted. The USN journal records both after the file is gone, which is why it outranks looking for the archive itself.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
