Based on the search results, the most relevant context for "who what where" in a digital/forensic setting relates to by Vound Software .
A feature that reveals hidden connections between artifacts, such as files sent by email, copied to USB, or downloaded from the internet.
It provides a single graph to view all user actions—who did what, where, and when—which can be annotated with tags and notes.