Crap ... sounds like a fun job .

Trend Micro is loosing it's credibility with me to, I'm a level 3 Trend Micro, but the guy teaching the classes to become it was a real ass hat ...

Anyway ... I'd state the obvious, clone the server, and do all necessary Forensic research ... I like this CD for that: http://www.lnx4n6.be/index.php?sec=D...ds&page=bootcd

The site sucks, but the CD's are good