Constant Insecurity: Things you didn't know about (PE) Portable Executable file format
Physical Memory Forensics for Cache
Beyond files undeleting: OWADE
Covert Post-Exploitation Forensics With Metasploit
Post Memory Corruption Memory Analysis