Putting the finishing touches on my upcoming presentation EVTXtract, a technique and tool for recovering EVTX records from unallocated space