Forensics snapshot method complete