I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I suspect, got in and erased many personal and system files.

I took a quick look at the windows event log and I see someone logging in at the time of the intrusion. I need an expert advice, but I have no idea what to look for in a person for this sort of task.

Any advice?

(windows 7 x64)


Since you mention you need to prove intrusion for legal purposes then it sounds like you may need to check into a certified computer forensics investigator. Hopefully the system is turned off (to avoid damaging evidence) until you decide whether or not to pursue forensics.

Here are a couple of links that might be helpful:



  • I've always been told to never turn a system off if you plan on pursuing an investigation. Forensics specialists like to be able to dump the memory, see what processes are running, etc. Not sure if this is one of those things that different people feel differently about though. – Kasius Sep 25 '12 at 19:22
  • 1
    @Kasius It varies depending on the problem. If you suspect the system is going to self-destruct and destroy evidence then crashing it hard is sometimes better than letting it self-destruct. Conversely if the "interesting" code is only in RAM pulling the plug destroys any chance at capturing that data. (You also need to consider the observer effect when acquiring memory dumps) – voretaq7 Sep 25 '12 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.