Hackers use a variety of means to penetrate systems.
Password guessing / cracking is one of the first steps. This allows access to the most sensitive information.
Password sniffing is a preferred eavesdropping tactic.
Vulnerability scanning aids hacker to identify which password cracking / other technique to use.
Key stroke logging /other spy ware tools are used as they gain entry to systems to keep up the attacks.
Invariably evidence of "having been there and done the damage" is eliminated by attackers .
Stealing files as well as Hiding files by way of Alternate Data Streams / Steganography is used to sneak out sensitive information.