An investigation into a compromised system may involve answering various questions, such as how did this occur or what security controls failed. I think it would be a good learning exercise to try to document the artifacts of a few exploits and delivery mechanisms. By Corey HarrellLink: Journey Into Incident Response