In a race against time, can you investigate a laptop seized by law enforcement to identify if a bomb threat is real or a hoax?

Our system administrators have lost access to an internet facing Windows Server, Managed Defence believe our systems has been compromised and have collected some assets and left them on the Desktop - Please help them!