Respuesta :

-organization's internet proxy server logs
- suspect computer's IP address
- suspect computer's disk drive
- your preferred computer forensics analysis tool