Ok, I have some security questions lets think about when somebody breaks into the system.
1. What to do to trace them.
2. How would you work out what they have been doing.
3. What they can do to destroy the evidence,
4. what the system would do to destroy the evidence, how would you figure out.
any help would be appreciated.