Live data forensics