www.foolmoon.net/downloads/Live_Forensics_Using_WFT.pdf