When investigators look over the computer, they’re not just looking through files, they’re reconstructing events. Every login or download, each browser session or deleted file,