...the ANALYZE phase, the IT forensicsspecialist analyzes the data content...process the data, the IT forensicsspecialist must have a fairly comprehensive...these entities. For the IT forensicsspecialist, this is treasure trove...
http://www.unixworks.net/papers/wp-011.pdf