KAPE: the VHDX filename is a label from the run

The filename is what the run was called

A triage package is often a virtual disk whose filename includes a timestamp and a host string from the collection command. That string is the label typed for the run. It is not a name read out of the disk. Renaming the file later changes the label and does not change the bytes inside.

The time in the filename is the run’s timestamp, not a logon time and not a file’s modification time inside the copy.

The copied records have their own names

Event logs and the registry inside the package name a computer. That name is what those artifacts recorded. If it matches the filename, say they match. If it does not, write both and do not pick the filename because it is easier to read.

A finding about “which machine” cites the name inside the artifact you used, and mentions the filename so the package can be found. The filename alone is not that citation.

What to file

File the filename exactly, the host label it contains, and the computer name from the artifact you opened, each labeled. File whether they match. Do not rename the package in the note to the name you wish it had.

Worked case: a file named for the wrong host

The package file is 2026-11-03T100311_WS-07.vhdx. A System event inside it records Computer ACCT-04. A draft says the event is from WS-07 because that is the filename. The bytes were not opened under the name ACCT-04.

The note quotes the filename as the package label and ACCT-04 as the computer name on the event. They disagree. The event is not rewritten to WS-07. Whoever handles the package can find it by the filename and still cite the computer field from the log.

filename: 2026-11-03T100311_WS-07.vhdx
label in the name: WS-07
Computer on the System event: ACCT-04
match: no
write: both
not: the event happened on WS-07