Investigators don’t just browse through files when they examine the computer. They reconstruct the events. Each login, downloaded file, browser session, or deleted file, and