Ditto, in particular would be good to know whether this is only for post--intrusion forensics or also useful ahead of time.