Here is a scenario you can think about. An administrator of a company has been accused of hoarding illegal material of questionable moral content on his company network system. You have been called upon to examine the suspect server and unearth evidence related to the said illegal material. Your boss has told you that you are not allowed to shutdown the server. Unfortunately no additional money is available to buy forensic tools or equipment. In this workshop we will explain, how to use free forensic tools to investigate such cases.