good article...

an even better reason is so you can help your organization have a solid recovery plan from a computer security breach or internal hacking incident.  basic incident response and forensics isnt too difficult but you do need to do it correctly and have a plan in place and the people identified before the incident.  trying to figure all that out in crisis mode is a recipe for disaster or at the very evidence that you cant use.