Forensics

File analysis by headers

File Recovery

http://www.cgsecurity.org/wiki/TestDisk

Live Virtual Machine analysis

Tools: volatility (Memory forensics, open processes, open files, etc)
- Cheat sheet http://forensicmethods.com/wp-content/uploads/2012/04/Memory-Forensics-Cheat-Sheet-v1.pdf