DFIR nonsense with Josh Hickman