Sooner or later, most IT folks will be asked to do some form of investigation, whether it's looking into misuse of email or the Internet, investigating a system compromise or even a rogue employee stealing company secrets. Most will have the technical skills and interest to help, but can easily get caught in the minefield of technical, legal and procedural traps that computer forensic investigations entail. Based on the philosophy that it's always good to learn from mistakes - especially someone else's - this presentation will be full of war stories and practical advice to help you get results while staying well clear of the deep stuff.