Follows the breadcrumbs from any selected user on a computer or mounted disk image. All you need to do is start the program, set a time zone, then select a user, and the program will grab artifacts relevant to that user's activity on the computer and put it together in an ordered timeline. This way you can closely follow exactly which files a user interacted with and when.