That's a lot of different things. Perhaps you could focus on one and try again. If I was doing forensic analysis on a server under such circumstances I would h

That's a lot of different things. Perhaps you could focus on one and try again. If I was doing forensic analysis on a server under such circumstances I would have made note and reference to that as well. The footnote is not forensic, and not evidence, and there's no good reason for it to be there. I doubt you are a forensic investigator so it isn't relevant what you think you would have done, but if you were a good one I suspect you would have kept packet logs of everything you saw.