1. A method comprising: capturing empirical information relating to the exercise of privileges by a plurality of instances of a software application, the instances of the software application executing on top of a plurality of instances of a platform; dynamically generating an application profile that describes the aggregate exercise of privileges by the plurality of instances of the software application based on the empirical information; receiving, with a forensic device coupled to a target computing device via a communication link, input from user that identifies computer evidence to acquire from the target computing device; acquiring the computer evidence from the target computing device with the forensic device; filtering the computer evidence on the forensic device with the application profile; and presenting a user interface for the forensic device through which the remote user views and analyzes, using the client device, the filtered computer evidence acquired from the target computing device.