A Formal Approach to Analyzing Cyber-Forensics Evidence