links for 2009-11-24 November 24, 2009 by Andrew Hay | 11780 commentshttp%3A%2F%2Fwww.andrewhay.ca%2Farchives%2F1178links+for+2009-11-242009-11-24+20%3A03%3A56Andrew+Hayhttp%3A%2F%2Fwww.andrewhay.ca%2Farchives%2F1178 Windows Incident Response: Working with Volume Shadow Copies (tags: forensics shadow windows) Windows Incident Response: Even More Linky Goodness… (tags: windows revealertoolkit tsk) Facebook Memory Forensics ยป SANS Computer Forensics, Investigation, and Response (tags: forensics facebook tools)