adding more forensics code