If you're talking about deep dives into the perpetrators and victims themselves, then this post is for you with a general suggestion + why.
If something is currently ongoing, it's good to set your search tool settings to "last hour/last 24 hours" and keep checking back. If you're months/years too late, setting searches to the following 1-5~ days of the post-attack date might help you. Shocked people who are unfortunately preyed on by journalists (or seeking comfort online by posting on their own social medias), are trying to process what's happened by giving info on the event/perpetrator/victims. Most of them stop talking about it over time because they probably realise it's only making their own lives harder to be in the spotlight, so many of the smaller, raw details are usually found very, very early on in reports/social media posts.
Also early on: a lot of people will repost what they've seen on perps/victims social medias before they're scrubbed or locked down. Be sure to check their personal social medias yourself if they're still up (fb, insta etc) and archive just in case, even if you're not sure if you want to archive, bc you might not have much time to decide. Better to cap/record/save first and decide later.
If you're looking for more info on specific things, use key terms in quotation marks in the search bar.
(Using quotations can also help you narrow down articles if you're having trouble recalling them. For example, I can never remember which dinosaur Payton did a recreation of, but I DO remember that the article used the word "sized" when describing it. So, putting payton gendron "sized" in the search bar - bam. Brontosaurus article.)
Twitter is really hit and miss, but the hits can be meaningful. I found Juraj's corpse pic via twitter, as well as his prism55 name - if not for that tweet, a LOT of discord posts would be missing. I did eventually find other sites confirming the prism55 name (the farms, and one of the wikis releasing an official statement about their ex-admin), but I never ever found another repost of that one corpse pic until I started reposting it.
In 2022, I saw the fb video reposted on twitter of Payton stepping over a christmas present. Back then, I took everything for granted so I didn't archive anything. AFAIK that video is now gone forever, only caps remain. So, if you see something and it's not successfully archived on wayback machine or archive.ph, then be sure to archive it.
When it comes to general events, we usually get more info over time (cctv, timelines, FOIAs, official statements, autopsy reports, etc). You might need to use quotation marks around these key words when trying to look them up. Different articles usually have slightly different info, so it's worth clicking on multiple similarly-named articles to see new info.
You might also need to utilise site:(sitenamehere, no spaces) when searching, especially if your case is in a different country to yours and you know the names of the non-english news sites. Sometimes, even with a vpn, our results are skewered.
I hope this tldr helped. Sometimes it has been the most random literally who tier blog sites who have had rare archived info (I personally saw this when researching Balliet and Payton) so don't rely on mainstream sources all the time.
Edit: even reddit can have info mainstream media reporting had missed, r/mk might come up in the results with helpful info. It's worth checking out.