Forensic analysis of computer evidence