Investigators don’t just look through files, but also reconstructing things that happen when they analyze computers. Every login to a computer, download file, browser session
Investigators do not simply search through documents, but retracing events when they examine computers. Each login, download, browser session, deleted document or connected device adds