Use when reconstructing user activity from browser and application data — history, downloads, cached data, and app databases that reveal what a user did and when.