[tbb-dev] TBB forensic analysis

hi all, I've read Runa's forensic analysis of the TBB (https://research.torproject.org/techreports/tbb-forensic-analysis-2013-06-28...) and I'm currently redoing the analysis of the current TBB. I'm more or less following what runa did (plus ram dump/hibernation file), I was wondering if you have any suggestions, ideas or any other kind of input on the subject. I asked on #tor and they suggested to say something here. jb