See the slides and  demonstration video’s that Gerard used in his Defcon talk “Forensic Artifacts of a Pass the Hash Attack”