http://ropgadget.com/posts/4.html#csaw16_forensics_kill

Original writeup (http://ropgadget.com/posts/4.html#csaw16_forensics_kill).