When I arrived at the location I was handed hundreds of pages of source code printed on an old dot matrix printer. It was hard to read and much of it looked like gobbledegook. I buckled down and started reading. After a few days of this eye-straining, headache producing work, I spotted a line that didn't appear as though it fit with the rest of the code. I started tracing the code from this line and within an hour was able to document what this guy had done. He very carefully injected code into this program that would have deleted all the data off of the company's storage array at midnight in another few days. He literally would have put them out of business. They did not have a disaster recovery plan in place. They relied on a full storage backup that was over a year old plus their nightly backups. To save time each night, they only did incremental backups to tape. If the bomb had exploded, it would have been a disaster trying to recover all of their customer and accounting information.
Once I walked the detectives and company officials through the source code, they called in the police. The gentleman was arrested on criminal charges and eventually convicted in a court of law. He went to prison. My work in the case as a forensic investigator and expert witness proved to be the essential element that won the conviction. I have worked with many attorneys over the years and have appeared in court on numerous occasions. If you need an expert witness or forensic IT investigator, I'm your man. Call me and let's discuss your case. My expert witness rate is industry competitive.