This is for an article I'm writing for Rob Lee's SANS Forensics Blog (coming soon to http://twurl.cc/91i)