I know, I’m sad, and I’m not ashamed of it. I get Microsoft’s Technet newsletter, and this time around there was a link to an extremely interesting article on investigation of computer misuse. It gives a step-by-step checklist, with reference to software tools used, to investigate computer misuse. The fictional case study they give is of a person working in a company who brags about knowing the salaries of his co-workers. At the end of the investigation, you can tell exactly why this person got to see the file with the salaries in it and how the investigation progressed.
Just for good measure they throw in the fact that the person also had lots of porn pictures on his work computer.