Investigators are not just searching through files, but reconstructing the events they observe when they look at computers. Every login to a computer, download file,