Thanks for the edit, I really liked the link to the cold boot abstract. Somehow I keep forgetting physical access in a world of radio-controlled computer implants and thunderbolt/firewire DMA.

The examples really made the article shine. I knew you could dump memory, but seeing identification tools in action is ... too easy! :)