Cybercrime is a very lucrative business not just because of the potential financial return, but because it’s quite easy to get away with it. Sometimes hackers get caught, but most of the time they still run free. When it comes to operating systems and after-attack traces, it is not that bad as all traces are gathered in one place—your infrastructure.
1: See a demonstration of forensic techniques to gather the evidence.
2: See a demonstration of conclusions with summary of what happened.
3: Learn how to search for the evidence and where it can be stored.