Thinking out loud…the ability to interpret/decode raw/hex-level data for certain artefacts that the automated tools don’t cope with (various reasons why this might happen), use of a comprehensive and effective keyword search (and subsequent review of results), ability to connect separate artefacts