Surfing the web, I have found a nice talk on Cisco IOS Forensics and Exploits, explained during the 25C3: “Cisco IOS Attack & Defense - The State of the Art“.

What is 25C3?
The 25th Chaos Communication Congress (25C3) is the annual four-day conference organized by the Chaos Computer Club (CCC). It takes place at the bcc Berliner Congress Center in Berlin, Germany. The Congress offers lectures and workshops on a multitude of topics and attracts a diverse audience of thousands of hackers, scientists, artists, and utopians from all around the world.

Here a summary written by FX
“To summarize the presentation given at the 25C3, the work is aimed at the possibility of performing forensic analysis for Cisco IOS devices. We identified a complete lack of tools and methods for detection of compromized network equipment approximately two years back. [...]

More info on http://www.ciscozine.com/2009/01/26/cisco-ios-attack-defense/