I guess the correct answer is the system administrator for the system in question.
The best source for technical information needed in a network investigation is the system administrator for the system in question.
9.5m questions
12.2m answers