Investigators aren’t just looking through files, they are also reconstructing things that happen when they analyze computers. Every login, downloaded file or session in a