– Using memory analysis to find evidence of malware and volatile artifacts. Book 4: Timeline Analysis