When an investigator examines the computer, they’re not just scouring through files; they’re retracing events. Each login, download, browser session, deleted document, or connected device