From Microsoft's technet - Fundamental Computer Investigation Guide For Windows: Overview. Using the <img src=/S/free.gif border=0 alt=free width=30 height=15> Microsoft TechNet: Windows Sysinternals tools to investigate. Pretty good stuff.

Joe