forensics triage — what happened?