Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Files moved to or from this host over SMB.
Collect first, these expire. The Security log rolls at its 20MB default, and the NTFS change journal rolls by size, on an active volume that can be hours. Both before anything else.
survivesUntil rolled out by the 1024-entry cap. On a normal workstation this is months.
does not proveWHO ran it — Prefetch carries no user context at all
the trap
ShellBags and LNK files. Both record Explorer activity, and a command-line or SMB copy leaves neither, their absence says nothing at all about a scripted transfer.
if you find nothing
The USN journal rolls by size and can cover only hours on a busy volume. Pull it before anything else if a copy is suspected.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
