A security professional investigates an alert about an unknown user accessing a system within their organization. What is the purpose of computer forensics in this situation?