After a computer has been compromised by a hacker, which of the following would be most important in forming a profile of the incident?