As DARPA puts it: "When we look through the evidence after the fact, we often find a trail--sometimes even an 'obvious' one. The question is can we pick up the trail before the fact giving us time to intervene and prevent an incident?" Computer forensics companies rise to the challenge.