SECOPS: Identifying Forensic Evidence