Pondering a Linux Forensics course for SANS. Feel free to email or tweet things you'd like to see in such a course.