Forensics

http://blog.gnist.org/article.php?story=HollidayCracking how to investigate rooted linux box