The Coroner's Toolkit (TCT)
The Coroner's Toolkit (TCT) provides post-break-in data collection that could be useful in determining what happened. Less polished that the authors (Dan Farmer and Wietse Venema) usual work, the toolkit offers a patch-work of tools that help exhume interesting stuff from violated systems. Should be installed and examined before a break-in happens!