KAPE: the destination path is inside the package

The row has two paths

A copy-log row names a source path and a destination path. The source is the path on the collected host. The destination is the location inside the triage package. They often look similar, with a drive letter dropped or a package root added.

Reading only one of them loses the other. The source is not “where the file is now.” The destination is not “where it was on the host.”

The analysis machine is a third place

The laptop where you read the log has its own disk. A destination that begins like a Windows path is still inside the package you opened, not a file on that laptop’s system drive. If the laptop does not have that path, the copy was not missing. You looked in the wrong place.

If the destination cell is empty, write “destination not on this row.” Do not treat an empty cell as a path on your workstation.

What to file

File the source path labeled as the collected host, and the destination labeled as inside the package, plus the package name. A sentence about “the file we have” uses the destination. A sentence about “the path on the host” uses the source.

Worked case: a package path opened on the laptop

Package LAB-02’s copy log lists source C:\Users\lab\Desktop\notes.txt and destination C\Users\lab\Desktop\notes.txt. A draft looks for C:\Users\lab\Desktop\notes.txt on the analysis laptop, does not find it, and says the notes file was not collected.

The note quotes both paths. The destination is inside LAB-02, not on the laptop’s system drive. The file is collected. The failed search was the wrong disk.

package: LAB-02
source: C:\Users\lab\Desktop\notes.txt
destination: C\Users\lab\Desktop\notes.txt inside the package
searched: the analysis laptop’s system drive
write: destination is in the package
not: the file was not collected