IT forensics: guilty until proven innocent