Extracting Windows command line details from physical memory. - Richard M. Stevens; Eoghan Casey (Digit. Investig., 2010)