One of the additional areas that I would like to see discussed in relation to pen testing is from the forensic side.  For example are there markers to be read in a memory grab, magic numbers for the processes that can be grepped from an image (or the memory), what are some of the tell tales that can be found post-mortem.  I know 508 covers some of the post-mortem topics, but in a live forensic environment there has not been as much presented.