1. A method for managing data in an electronic system for forensic analysis, comprising: operating the electronic system; collecting a record of network activities occurring in the electronic system as the electronic system operates; collecting a record of storage activities occurring in the electronic system as the electronic system operates; associating the record of network activities with the record of storage activities to obtain forensic information about events affecting both network activities and storage activities, including applying a common timing reference to the record of network activities and the record of storage activities to associate network activities and storage activities with one another in time; and aligning in time the record of network activities and the record of storage activities by identifying multiple record entries for each of network activities and of storage activities corresponding to substantially the same points in time.