I recommend watching "Case of the unexplained". Mark is showing practical examples of using sysinternals tools, it really gives a glimpse of how skilled he is.

http://technet.microsoft.com/en-us/sysinternals/bb963887.asp...