So . . . what have we learned here? We learn that when you want to collect evidence from a computer, you get somebody who knows how things work. What you don't get is some office bimbette who doesn't have the sense to turn off the Internet connections before doing anything else. Sheesh!
Really? And you turn off your internet connection every time you turn you computer on? Your first thought (w/out knowing the plot) would have been "What's going? Oh! someone is remotely wiping the hard drive, let me un-plug the internet?" Probably not.
Honestly though, I thought it was a bit far fetched that she even knew that there was something wrong with it rather than thinking it was just updating.
I use to work at a call center for pc repair and I can still remember when I was being trained that I would have to listen into calls and most secretaries have no clue. One even thought the disk drive was a coffee cup holder and couldn't figure out why it wasn't coming out to hold her coffee cup!
So yeah I don't buy the fact that she knew that there was something wrong. But there is no reason at all for her to think someone else was doing that, so why would she take that precaution?
But in the end, we all know whats going to happen. She stuck that flash drive in at the right precise time and grabbed the exact info that is needed to break this case open. (again, very far fetched)
"The dark side of the Force is a pathway to many abilities some consider to be unnatural."
I used to train the people who did what you did. The FIRST thing you do is isolate from the network, be it LAN or WAN. Remember that users are broken out of the box and you'll save yourself a lot of heartburn.