https://www.sans.org/reading-room/whitepapers/forensics/virtualization-internal-forensic-training-assessment-36662