FEDS is a breach investigation tool designed to expedite the discovery of evidence after a compromise of a database server. This tutorial will take the class through how to set up a new case and gather then process evidence files after a breach. Once all the processing has been performed records of interest will be located with the effective use of filters then collated and correlated producing a complete time line of events.