Investigators don’t just search through files when they look at the computer. They also reconstruct events. Each login, download, browser session, deleted document or connected