Investigators aren’t just looking through files, but also reconstructing instances when they study computers. Every login, downloaded file or browser session deleted file or device