The use of Virtual Secure Mode (VSM) limits or complicates forensic investigations, including for security incident handling. Processes that are protected by Secure Kernel or Isolated User Mode (IUM) are no longer accessible. For example, memory images of these processes cannot be evaluated due to cryptographic measures.