The various records kept by computers can often be a good place to look for forensic hints about what happened to a computer. The records kept by the software can reveal anomalies and sometimes details that identify the attacker.