New answers tagged incident-response
Beyond the tools that Kyle mentions if you need something you need to run from time to time check out BriMorLabs Live Response Collection it might be able to provide you all the data you could use to start to do a root cause analysis on the system.
Live response is a common and accepted practice today. A number of commercial and open source tools can gather volatile data, because immediately pulling the system off of the network can also be disruptive to the forensic validity of your evidence. The key is not "don't change anything", but rather "be able to explain and have documentation for any ...
It's unclear from your question if the hard drive content was properly deleted. Re-installing the OS certainly doesn't guarantee that the drive has been wiped out. If the drive was pulled out of the infected computer and replaced or properly wiped out on another machine then it would be plausible to ignore the possibility that malware is still present on it. ...
Top 50 recent answers are included