OS version, computer name, and registered owner.

Search queries, downloaded files, and saved credentials.

Evidence of data exfiltration, malware execution, or specific communications.

Before extraction, calculate the MD5 or SHA-256 hash of the file to ensure the evidence has not been altered.

Ensure all subsequent parts ( part_2 , part_3 , etc.) are in the same directory.