Most internal investigations produce findings that are correct and useless, because nobody can show where they came from.
The difference between a note in a chat window and evidence is not the quality of the analysis. It is whether you can demonstrate, later and to someone unfriendly, that what you are showing them is what was on that machine, and that it has not changed since.
Two habits give you that, and neither is difficult.
Hash everything at the moment of collection, and record the hash somewhere separate from the thing it describes. A disk image with a SHA-256 written down at acquisition can be proven identical months later. The same image with no hash is a file that somebody could have edited, and once that is arguable in a room, the technical content stops mattering.
Then keep a chain of custody, which is a plain list: what was collected, when, in UTC, by whom, from which machine, and where it has been stored since. Every transfer is a line. It sounds bureaucratic until the first time you are asked "how do we know nobody altered this in March", and the answer is a document rather than a shrug.
Collect in order of volatility, because some evidence expires faster than others. Memory and the CPU state disappear on power loss. Network connections and running processes disappear on reboot. Temporary files and swap survive a reboot but not a reimage. Disk survives both. Logs on a remote server survive the machine itself, which is exactly why forwarding them mattered in the first lesson.
Work on copies, never on the original. Mount images read-only. If you must examine a live system, know that your own commands are changing it and write down what you ran, so the next person can tell your footprints from the attacker's.
One thing that catches people out: timestamps lie in three different ways at once. Filesystems record several of them and malware routinely rewrites the visible one. Different systems record different timezones. And an attacker who has been in the network for a month has had a month to tidy up. Corroborate any timeline across at least two independent sources — a host artefact and a network record, ideally — before you build a conclusion on it.
Last, and this is the part that separates a useful report from a technically impressive one: state your confidence and say what you could not check. "The account was used from this address" and "we believe the account was used from this address, based on one log source we could not corroborate" are different sentences, and only one of them survives being wrong.