Investigation and digital forensics. Following the clues, reconstructing what happened.
One of the worst cases I worked got harder before I ever touched the laptop.