When investigators examine computers, they’ren’t only looking for files. They’re also reconstructing the events. Every login, download, browser session, deleted document or device connected adds