Post-incident device forensics