While at FOSE last week, I attended a very good session called SANS Forensic and Incident Response. The session was led by Rob Lee from Mandiant who moonlights as a computer forensics trainer. Rob ...