I am being asked to perform a forensics investigation on a network. The reason being that for the past few months strange things are happening on the network. VLANs are being deleted, configuration changes are being made, and all sorts of modifications are occurring on the network devices. IT ranges from the Firewalls, through the SSL VPN device and all up to the switches. The system administrators are feeling like they are being toyed with, and I was asked to see if I can find anything (this hasn't been labeled a real "forensics investigation" since I am no forensics investigator, but was simply asked to give me best effort on this).
The question is, how do I go about it? Does it all just come up to collecting the logs and looking for events around the time that the company felt the changes? Is there any basic methodology "for-dummies"? Is this sort of investigation an easy task or is it tedious and boring, time-consuming effort?