AUTOPSIT

Computers involved in an incident need to be fully analyzed: memory, disks and logs. Those assets are precious as they give a clear and complete view on what happened on analyzed systems... As computer communicate, being able to handle network traces allows to build a picture of attacker activities and eventually identified all the systems involved in the incident.