Check out this recent addition to the SANS InfoSec Forensics Reading Room. It contains an interesting report that includes some methods and techniques to uncover digital evidence related to a SQL Server 2005 security incident. The report follows proper cyber forensics investigative procedures, and the data acquisition section will definitely increase your personal knowledge portfolio.
