https://www.sans.org/reading-room/whitepapers/forensics/investigative-forensic-workflow-based-case-study-vectra-cyphort-36522