Investigators don’t just look through files, but reconstructing things that happen when they analyze computers. Every login, download, browser session, deleted document or device connected