Identification should include brief descriptions of the following:
Registry
Log files
MAC timestamps
File types
File slack space
RAM slack space
Unallocated space