Investigators do more than just look through documents when they check computers. They reconstruct events. Every login, downloaded document or session in a browser deleted