1. A computer implemented method for forensic monitoring, comprising: monitoring, by a monitoring module of a monitored apparatus, activity on the monitored apparatus; extracting, by a processor, forensic data from the monitored apparatus based at least in part on the monitored activity, the forensic data including one or more point-in-time views of system state of the monitored apparatus; causing transfer, via a network, of the extracted forensic data from the monitored apparatus to a forensic analysis apparatus configured to archive the forensic data for a later analysis; preserving integrity of the extracted forensic data; preserving chain of custody information of the extracted forensic data; and causing the forensic analysis apparatus to determine one or more key risk indicator values relating to the monitored apparatus based at least in part on the later analysis by applying one or more rules to the extracted forensic data, wherein the key risk indicator values indicate potential risks of intrusion caused by activity occurring on the monitored apparatus.