A table listing every file, its size, and its suspected function.

Look for README.txt , manifest.json , or [Content_Types].xml files, which often describe the package's origin and versioning. 3. Forensic Analysis (If Required)

Any scripts, hidden files, or unusual metadata found.

Use tools like certutil -hashfile [filename] SHA256 on Windows to generate a hash and compare it if a checksum was provided by the source.