@hyde

Hint: forensics won't even touch the live session, just duplicate the storage and dig there ;)