On Mon, 2004-01-26 at 13:35, Don Calfa wrote:
> I have a Win2K laptop that I need to investigate what has been removed 
> (disgruntled ex-employee).

STOP!  Will there be possible legal action against this employee?  If
so, don't do anything to the laptop yet.  Have it imaged by a
professional forensics investigator.

If this laptop won't be considered evidence, then proceed.

Gary