Tracing down the hacker
Here is a good step by step procedure by which a system administrator traces the hacker who hacked his friends machine. Its nice and interesting. You can read that from this link http://blog.gnist.org/article.php?story=HollidayCracking
