I'm downloading it now. I deleted all the apps except the basic Mac apps. I'm going through the activity monitor trying to find things that don't look right.
There was a VPN client which I'm assuming he's used.
Well, at this point, it's all idle curiosity on her and your part. The first thing you should have done is image off a couple of copies of that drive. One for archive, the other to examine.
A ram snapshot would have been good as well.
Ah yeah. Good idea. I don't think it's really that big of a deal, I think she was just curious. I would be too. Everything looks ok for now though. I don't think he would be that smart working for a company around here.