Make hash verification part of the reasoning
For hash verification, evidence should be selected before writing the conclusion. Record the observation, identify the relevant context, then explain what the observation can and cannot prove. This avoids overclaiming and gives the autopsy digital forensics report a more defensible academic tone.
Where possible, compare the expected state with the observed state. For autopsy digital forensics, that comparison gives the reader a clear basis for judging whether the control, configuration, artefact or result is acceptable.
Show why file-system artefacts changes the conclusion
Students often lose marks by describing file-system artefacts without evaluating it. A better approach is to compare the expected behaviour with the observed behaviour, identify the security consequence, and justify the next control or investigative step. That sequence keeps the discussion specific to autopsy digital forensics.
A useful discussion also acknowledges constraints. Time, available evidence, lab scope, legal boundaries and incomplete data can all limit what can be concluded about browser artefacts or metadata.