Just like his blog in sysinternals.com, Mark's technet blog investigates complex problems. He shows the full details of how he approach the problem, how to progress the investigation, and how the culprit is found.

Subscribed.

http://blogs.technet.com/markrussinovich/