Type: Posts; User: IchNiSan; Keyword(s):
Start here.... http://www.sans.org/rr/incident/ its a great set of documents.