I need an expert on a subject I know very little. I had a breach on one of my Windows systems. I know how someone got in but for legal purposes I need to prove that some former employee, whom I suspect, got in and erased many personal and system files.
I took a quick look at the windows event log and I see someone logging in at the time of the intrusion. I need an expert advice, but I have no idea what to look for in a person for this sort of task.
(windows 7 x64)