Updated forensics notes