Most players read a case file looking for clues. That is backwards. Build the timeline first; the clue is whatever does not fit.
Find the time of death. It is in the autopsy, and it is usually a range. Write it at the top of a page. Everything that happens inside that window matters; most of what happens outside it is scenery.
Go through every document and write down every time you find, with the document that says it. Phone logs, receipts, booking sheets, weather records, cab logs. Do not interpret yet. Just collect.
For each suspect, mark where records put them at each time — not where they say they were. A statement is a claim; a receipt is a fact. Suspects with a record placing them elsewhere during the window are out, however strong their motive.
One suspect's statement will conflict with a record — a call made after they said they left, a code on a receipt, a witness who mentions them in passing. That contradiction is the case. Everything else (weapon, motive) is then a matter of reading the right two documents.
The game only asks who, and you get one accusation, so before you submit, make sure your killer is supported by at least two documents and that the weapon and motive you have in mind fit the same records. If any rests on one, keep reading.
Every case file is written the same way: people talk, and machines keep time. A witness remembers that it was "around ten". A parking meter, a toll booth, a switchboard or a card reader records 21:47 and does not care who is asking. When a statement and a record disagree, the record wins almost every time. The only exception worth checking is a record that someone could have tampered with, such as a log that was filled in by hand after the fact. If a document was written later than the event it describes, note who wrote it and when.
A single sheet works better than notes spread across the documents. Draw a line down the middle of the page and write the times on the left, from the earliest to the latest. On the right, write what happened and which document says so. Give each suspect a color or a letter. When two entries share a time, put them side by side; that is usually where something interesting sits. Keep a separate short list of things you cannot place yet, like an undated note or a call with no time, and come back to it once the rest is filled in.
Chasing the motive first. Everyone in a well-built case has a reason to want the victim dead. Motive tells you who to look at, never who did it.
Trusting the first theory. The original investigation in a cold case usually settled on someone. Treat that conclusion as one more claim to test, not as a starting point.
Skipping the dull pages. Weather reports, shift schedules, receipts and maintenance logs are where the fixed times live. The dramatic interview is rarely where the case turns.
Accusing too early. If your answer depends on one document, you have a hunch, not a solution. Go back to step five.
The timeline method splits well between players. Give each person one folder, have them pull every timestamp from it, and then build the shared timeline together. Disagreements are useful: when two players read the same line differently, read it again out loud. In a room everyone votes in secret and the host reveals the answers together, so argue it out before the reveal, not after.