A first tool of choice when analyzing a suspect computer