Jackson Company manufactures pet supplies for birds and cats. Its top-level staff includes two accountants, a technology coordinator, a production manager, a warehouse manager, an office manager, two sales managers, two assistants, and the CEO. The company's main offices and manufacturing plant are in Los Angeles consisting of an office building, a plant building, and two small warehouses. All buildings are connected via underground fiber optic cable. The servers, hubs, and routers are stored in the main office building.

The brain behind the IT network includes three server machines, named Washington, Jefferson, and Adams. The Adams server hosts the Mixta accounting system, which processes all internal and external accounting transactions in real time.

A recent audit by a regional accounting firm discovered six customer accounts that could not be traced back to real people. The auditors' confirmations had been returned in the mail, marked "Undeliverable" and with "invalid address" stamps. To make things worse, all six accounts had been written off for nonpayment of amounts ranging from $4,200 to $7,000. The discovery was a complete surprise to Sandra Winger, the credit manager, because she always reviewed and personally approved all write-offs over $2,500. She was sure that she had not approved any of these.

Sandra called in Tom Surefoot, a local forensic accountant, to investigate. She was sure that fraud was involved, and she strongly suspected that Betty Beanco, one of the office managers, had somehow gotten into the accounting system and set up the phony customer accounts and had probably sold the written-off accounts on the gray market. Sandra was furious.

"I don't care how much it costs," Sandra told Tom. "I want you to catch that woman. I'm not going to let her get away with robbing me like that."

How could Tom apply computer forensics and other techniques to determine whether or not Betty Beanco should be a suspect?