While some investigations rely on highly trained professionals using expensive tools and complex techniques, there are easier, cheaper methods you can use for basic investigation and analysis. In this article, we will focus on computer forensic techniques that are readily accessible to you as a mainstream administrator.

http://download.microsoft.com/documents/uk/technet/downloads/technetmagazine/CompForensicsUKdesFIN2.pdf

Urs