Linux forensics will always be my favorite thing, because inevitably I end up building a findings table named "angry admin or hacker?" which is just a series of cmds and args filled with profanity that could go either way.