malware response windows analysis forensic encase incident hash unallocated trojan footprints investigation bitlocker responders