Update and rename forensic.md to forensics.md