Update forensics.md