This document, written by Dave Dittrich, provides a great foundation for performing a postmortem on your box once it's been rooted.