The article suggests ways to gather physical, software and human evidence to serve as guides for adapting basic investigative skills to computer-related incidents, whether they involve physical damage to equipment, manipulation of programming code, or simply the use of the computer as a means to an illegal end. Physical evidence, for example, may involve photographing damaged equipment and transmission lines and securing the scene of the incident, after inspecting it for details that may reveal habits or peculiarities of the perpetrator. Important evidence which may be culled from system audit logs includes transaction histories, reconciliation, error reports and chronological reports. By taking their traditional skills into this new arena, security managers can successfully unravel any illicit activity targeting their organizations’ electronic assets.