Update forensic.cfg