Computer Forensics Can Do

1. Who accessed what information and when
2. Who created/edited/deleted what and when
3. What documents were copied, and to what device
4. What was the content of communication between employees and outsiders
5. What other out of policy acts were attempted by the use of information systems