Security Monkey published a good case study about evidence seizure and what happens, if you forget to asses all relevant system data after a security incident occurs.SecurityMonkey’s conslusion should be printed bold: Exclude pieces of your systems from assessments with care.