Ashton, a digital forensic examiner for Cadence Irrigation, is conducting an internal investigation into the alleged theft of trade secrets from Cadence. Kirby, a Cadence employee, is the prime suspect. Ashton decides to seize Kirby’s work computer for forensic examination. If, at the time of seizure, Kirby’s computer is turned off, Ashton should turn it on before seizing it. How can digital forensics be used to investigate intrusions? How does it differ from criminal digital forensics?