Rogue,

I took a great course offered by CSI "Technical Recovery of Electronic Evidence, and have been reading many books, and setting up my own personal lab to recreate these situations. I have mentioned the book I just finished multiple times in the threads, but I found it to be a great learning source. "Incident Responce" it was written by foundstone, same group that released hacking exposed.