Imagine you are a digital forensic investigator for a healthcare organization. You learn from your internal information security department that an employee has been using password-cracking software to access confidential customer insurance information. The account information extracted is unknown at this time, though it appears as though multiple computers were being used for the crime and it isn't clear whether an attack is currently in progress. The employee has been detained but his computers remain online.