================================================================================
  LESSONS FROM A REAL JOB
  Why this kit looks the way it does
================================================================================

  WHAT HAPPENED
    A customer was phoned, sent to a fake bank-support website, and talked into
    installing a remote-access program. The scammers were connected for hours
    and set up overseas transfers. The bank was also fooled by a phone call.

  WHAT AN EARLIER VERSION OF THE SWEEP GOT WRONG
    * It reported the PC as "essentially clean". That was an over-claim: it never
      looked at the second drive where the customer's Downloads folder lived, and
      the remote-access program had already been uninstalled, taking its own
      session log with it.
    * What actually answered the case was the BROWSER'S OWN RECORDS: a look-alike
      address TYPED into the address bar, a FORM submitted seconds later, a file
      downloaded from a second site seconds after that, and the remote-access
      installer downloaded a minute later. The Windows event log then dated the
      service install a minute after that.
    * A second copy of the remote-access program was downloaded half an hour later.
    * Dates in the old report were month-first ("11/10/2026" = 10 November).
    * A "HIGH - cloud account signed in" finding frightened the customer; it was
      leftover folder names from the year before, not an account.

  WHAT WE LEARNED
    1. Look on EVERY drive, and report the drives you did not look at.
    2. A tool being uninstalled does not mean the evidence is gone: browser history,
       Prefetch, BAM, the firewall log, the Recycle Bin and shadow copies remember.
    3. A name is not evidence; a date inside the window is.
    4. Say what failed. "None found" must only ever mean the check ran and found none.
    5. The history shows pages visited on THIS PC - it cannot say who was at the
       keyboard, and it cannot show what was typed into a form.
    6. Your own work contaminates the picture. Record what YOU installed or ran
       (a scanner, a credentials tool, winget) so nobody blames the scammers.
    7. Do not tell a frightened customer something you cannot prove. Wording carries
       confidence.
    8. Cleaning the PC does not recover the money. The bank, the phone and the
       customer's accounts matter more than the computer.
================================================================================
