https://www.sans.org/reading-room/whitepapers/incident/building-home-network-configured-collect-artifacts-supporting-network-forensic-incident-re-37302