DFIR process documented on officewiki
Closed, InvalidPublic