Analyzing a suspicious file without running it

Objective

Faced with an unknown file found on a compromised server, answer: what is it, what does it do, where does it come from, when was it dropped? — without ever running it, because running it would hand control to the attacker and destroy evidence.