DFIR process documented on officewiki
Open, Needs TriagePublic