Why collect memory? Memory Forensics During Incident Response Jack Crook Incident Handler Works for GE Founded RaDFIRe Handlerdiaries.com IR in a nutshell Consider the following…