Investigators don’t just search through files when they look at the contents of a computer. They reconstruct the events. Every