diff --git a/Forensics/README.md b/Forensics/README.md
index ab7cc30..c6a9a24 100644
--- a/Forensics/README.md
+++ b/Forensics/README.md
@@ -1,22 +1,60 @@
# Forensics
+## Disk Forensics
-## Tools
+### dd
-### Scripts:
+### strings
+
+```shell
+$ strings /tmp/mem.dump | grep BOOT_
+$ BOOT_IMAGE=/vmlinuz-3.5.0-23-generic
+```
+
+### scalpel
+
+### TrID
+
+### binwalk
+
+### foremost
+
+### ExifTool
+
+### Hex editors
+
+### dff
+
+### CAINE
+
+### The Sleuth Kit
+
+
+----------
+
+## Memory Forensics
+
+### memdump
+
+
+
+### Volatility: Analysing Dumps
+
+* [I have a lot of material on Volatility and Memory Forensics here](volatility.md)
+* I highly reccomend their training.
+
+---------------
+### Scripts
+
+#### PDFs
+Tools to test a PDF file:
-- memdump
- pdfid
- pdf-parser
-- dd
-- strings
-- scalpel
-- TrID
-- binwalk
-- foremost
-- ExifTool
-- Hex editors
-- DFF
-- CAINE
-- The Sleuth Kit
-- Volability
+
+
+-----------
+## References
+
+* [File system analysis](http://wiki.sleuthkit.org/index.php?title=FS_Analysis)
+* [TSK Tool Overview](http://wiki.sleuthkit.org/index.php?title=Mactime)
diff --git a/Forensics/memdump.md b/Forensics/memdump.md
deleted file mode 100644
index 256a6a7..0000000
--- a/Forensics/memdump.md
+++ /dev/null
@@ -1,6 +0,0 @@
-## memory dump
-
-```
-strings /tmp/mem.dump | grep BOOT_
-BOOT_IMAGE=/vmlinuz-3.5.0-23-generic
-```
diff --git a/Forensics/readings/DFRWS-EU-2015-short-presentation-1.pdf b/Forensics/readings/DFRWS-EU-2015-short-presentation-1.pdf
new file mode 100644
index 0000000..16e1269
Binary files /dev/null and b/Forensics/readings/DFRWS-EU-2015-short-presentation-1.pdf differ
diff --git a/Forensics/readings/DFRWS-EU-2015-short-presentation-2.pdf b/Forensics/readings/DFRWS-EU-2015-short-presentation-2.pdf
new file mode 100644
index 0000000..4fe29ca
Binary files /dev/null and b/Forensics/readings/DFRWS-EU-2015-short-presentation-2.pdf differ
diff --git a/Forensics/readings/DFRWS2014-p1.pdf b/Forensics/readings/DFRWS2014-p1.pdf
new file mode 100644
index 0000000..dbd19f1
Binary files /dev/null and b/Forensics/readings/DFRWS2014-p1.pdf differ
diff --git a/Forensics/readings/DFRWS2015-5.pdf b/Forensics/readings/DFRWS2015-5.pdf
new file mode 100644
index 0000000..fc65bc8
--- /dev/null
+++ b/Forensics/readings/DFRWS2015-5.pdf
@@ -0,0 +1,9140 @@
+%PDF-1.6
%
+38 0 obj
</M(D:20150713205918+05'30')/Name(ARE Acrobat Product v8.0 P23 0002337)/ByteRange[0 132 9666 2473968 ] /Reference[<>/Data 38 0 R/TransformMethod/UR3/Type/SigRef>>]/Prop_Build<>/App<>/PubSec<>>>/Type/Sig>>>>/Metadata 247 0 R/AcroForm 243 0 R/Pages 63 0 R/Type/Catalog/PageLabels 150 0 R/OutputIntents[212 0 R]>>
endobj
114 0 obj
<>
endobj
196 0 obj
<>
endobj
247 0 obj
<>stream
+
+
+
+
+ Elsevier
+ 2015-07-13T20:59:18+05:30
+ 2015-07-13T20:59:18+05:30
+ 0010-01-01T00:00+05:30
+
+
+ PDF/X-1:2001
+ False
+ Acrobat Distiller 8.1.0 (Windows)
+ PDF/X-1a:2001
+ 10th July 2015
+
+
+
+ application/pdf
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ doi:10.1016/j.diin.2015.05.005
+
+
+
+
+ PDF/X-1:2001
+
+
+ PDF/X-1:2001
+ PDF/X-1a:2001
+
+
+ uuid:ab10543e-1335-4449-a277-6225283b020f
+ uuid:63d494a9-e647-46a8-b139-ef38abc45220
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+endstream
endobj
243 0 obj
<>/Encoding<>>>/SigFlags 2>>
endobj
63 0 obj
<>
endobj
150 0 obj
<>
endobj
212 0 obj
<>
endobj
50 0 obj
<>stream
+hwSMňd1KĀ P(3qsҐs, s~t|·[իWUjƊ,m4dv3^{mN>1{!Xɘk|}}ڷ߳<T;wK"e(M`/zx8!dB!Øys|1`̛0,/o?b
'e~d0d.]0g~Cy}{_dNax;~"m/_=~]c&M5ָ{+KN&/_ptuavyKؿISؿ1>}ܽ/lb0Nv-ꚇLaCΘ!##+;sYrrgϙ3wy
+
+JJ/XpE/Yte˗XrڪUZZ::WYvuoذqM7obbbjuٶm۷رs]w[Xٳw}VV8pC[[9rݱcǏ8qéSO;:9|˹sϻ]qK/_rkׯ߸u@[L&f B#bIRMs8\.BH$GDDFFEEG'$$&&%%'K$))iiRiffVVvvNNnn^^~~AAaaQQqqIIiiYYyyEEeeUUu55uu
MMw47{^_
?|ǣO?}/^LLLN|95o}>|_|?|>=ϟ~?G?ÀOߠ?49zbꇊJC2qw138eC38
+{Aa/soYM,e6
}u~l$|+cXKC')I,1tc<9$t Hh{)GQKP*CJA]!yIrZ^՜Mù`u~ԧs k䩈K{-!hJb6d'l; LG@h!9 Kk/VC@⟪3xEA' Uwy%F0v6PP9ul44i7h-HF
_Wp߭B9O!m I* 7Hf(\ %? AI3(Ǐ"@M^r~8,|0lW)l7]f+i90
+F8Ჷ Ф|`sȚd p<2t- >DӾi@ o[n`՝
+c_أI*iGձQl{wᘵW(줈ʤְw#ס;ps@)Xs8*p}Dl>pwrЊ^2_2OشWildˤزI)Ufl\YA,ζŮ/d?
Z l^bDm;2O=%PskBМcK-/'X9WWҲd4Y9ͥ4ɟbVW6A/Șۊ)7D_1g#a}Ejz&Y~wPqfYϺV -b]̛q
+'۾<KEYY,aZ[V^x՛tdO9G&ٮf?;tM|JeKeK&d.wXKM,2e睵=; ~Y$nf!i0%VdO=kvtnn
̄;T M7RbԪ<bw_d-^ʒ*k`,J|3X:YrQ,#
+3lVRk>k2h58_l8`xJ)`g2mٲ|k7;Νȋ`M{/,|Q\&sCɚb=r`Ʋ"%Qk4^Y7ΦZd'fm:Ùo&̮@fECZfNSI3nR]jübjӉN&J?]V[iٛmci'^dՇ.d6'dn|vlz0-w`qC4
+
+
fBzha$zC/Zm̂u,a V5.]ГQ%`Lz}T]nDz葤V9$-iTUى=ڏh#}I="} g#֊n8"!^Qաw߁QK\JJn7H!'9\!ӳf6VC&2;AqoH-c~!h=ٸCOs̡^THUZ1'+3lڕMGw6dAeiҍPXr&hA^KХ!OQD(Pk|{EGB*BkoxgKI`;T