Question: Do a comparison of using network forensics for a case of an intrusion as opposed to a criminal case. What actions are the same and what actions are different? What would be indicators that a case that was thought to be just a simple intrusion and a curious could employ become a criminal referral?