Btw, here are the slides from my SANS2010 Command-Line Kung Fu talk, chock full of yummy forensic goodness: http://bit.ly/bmnRRr