Sounds like a lot of fun (actually)!

What OS? I assume Windows? What kind of artifacts have you already discovered?

DNS is a surprisingly fruitful thing to pay attention to.

Some viruses will delete themselves if they detect things like Wireshark or Python are installed.

I believe this is one of the big boy tools, though I haven't used it: https://www.volatilityfoundation.org/about

https://www.varonis.com/blog/how-to-use-volatility looks like a fun exercise.