Beyond the application directories,
how did they actually get to that file share?
Look for text messages.
So here, we can see this db.tt.
If you don't know what that is, and you're like,
maybe it's Dropbox, create a link for yourself.
Google it.
See what it actually is.
Look at the timestamp.
Follow that timestamp to see where it leads you.
So here, we can see it leads us into browser history.
We can then see all the files that were accessed.
Timelining will really help you with file shares
that are used because you have to follow that process.
If you're in Axiom, click on that Relative Time filter,
and type in how many minutes before
and after or days that you want to look.
If you're in Physical Analyzer, use the go-to, and hop
to the timeline.