Investigators don’t just look through files, but also reconstructing instances when they study computers. Each login, downloaded document or browser session deleted file, or device