Dave Hull has this nice blog article describing the use of the concept of "Least Frequency of Occurence" principle that Peter Silberman spoke about at SANS Forensics Summit. Please keep in mind that it is a hypothetical scenario based on an actual case. So there possibly are better ways of "finding the evil", in the hypothetical case, but its meant to show how this concept works.
Read more here.
