"Places that he went on the Internet, what he did when he was there, if he viewed images, if he placed orders—different things like that," Caruso says. "We can look at email that he sent and received from his different accounts."
The team can recover files even if the author thinks they've been sent to the trash.
"You see the date of the creation of the file and the user who created that file," Caruso says.
Investigators use documents, emails, and even instant messages to piece together motivation and behavior.
"It's a very long process of going through everything that's on the hard drive and that's recoverable to make sure nothing's missed," Caruso says.
But how useful is that high-tech trail? Consider the case of college professor Thomas Murray. When Murray was accused of beating his wife to death in 2003, it took cyber sleuth Dean Brown to crack the case. Brown went to work digging up everything Murray had typed into his Internet searches.
"One of the first things we saw was this term here: 'How to murder someone and not get caught,'" Brown says.
He also discovered that the meticulous linguistics instructor logged onto his computer like clockwork every Thursday. But the day his wife was killed, there was no activity, according to Brown.
Other bits and bytes came together, and ultimately Brown's digital detective work sent Murray to prison for first-degree murder.
The Virginia Tech families will never get that kind of closure. But the data recovered from Cho's computer should help answer the burning question: "Why?"