Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
Order of volatility
The expensive mistake in the first hour is spending it on a source that will still be there tomorrow while one that rolls hourly quietly empties.
Memory, if the host is still running and you are permitted.
The change journal, which on a busy volume covers hours.
Event logs, 20MB by default and under a day on a domain controller.
Everything on disk, which is still there next week.
An external device was attached and files were moved to it.
Collect first, these expire. The change journal rolls by size and is what shows files moving to a volume that has since been unplugged. Hours on a busy host.
Device connection records on their own. Knowing a drive was plugged in is not knowing anything was written to it: the LNK volume serial and ShellBags are what tie a file to a specific device.
if you find nothing
ShellBags survive the drive being removed and often preserve the folder structure of a device you will never see, which makes them the best starting point rather than the last resort.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
