Does the term "forensics" imply after-the-fact analysis when something bad has happened to the computer, or is some other incident being analyzed and it's hoped that info on the computer will help with that investigation?