Sans reading room

I like to look around the reading room from time to time looking for something to read and I found this one really interesting.

http://computer-forensics.sans.org/community/papers/examining-unknown-image-analysis-compromised-honeypot_200

Forensics is so cool

This has an excellent write up from start to finish.