“Unfortunately, problems do not come to the administrator carefully wrapped in bundles with the value elements and the factual elements neatly sorted.” - Herbert Simon

Background
The complainant (software company based in Bangalore) alleged that some of the company's former employees had accessed the company's IT system and tampered with the source code of the software under development.

Investigation
The investigating team visited the complainant's premises and scanned the logs of e-mails. They identified the IP address and using tracing software traced the ISP and the address of the place where the e-mails had been sent.
This address was of a Hyderabad based company. On visiting the company the investigating team found 13 computers and a server. Using specialised forensic tools the disks were imaged and analysed by the team. The analysis revealed that the original source code as well as its tampered version had been stored from these systems.

Current status
The investigating team arrested the accused in India and efforts are underway to arrest the others who are presently in the US.