Alrighty then. Quick bagel breakfast, check. Juicebox, check. Tablet, check. Super-awesome epic skills, check.
We're gonna go snooping today. Ranell and Delmar are running my job for today, so I've now got the time to look around and see if I can find any clues as to who's been stealing copies of the files, as well as building their own portal.
First of all, the networked files seemed to obviously be streamed, as made apparent by the crazy flurry of alerts that the firewalls have been barfing out. I'll start with a simple IP tracking...
...
...
Oh. So apparently every accessed file within the past half a month has been on localhost... that is, the server itself is pulling files. Welp. That only makes the case even more suspicious, considering how only people on the project have access to this thing.
Unless...
Nope. No tunneling I can detect, no proxies, VPNs, etc. etc... so yeah, I'm pretty sure now that someone is doing this while noone else is looking.
I can't do any fingerprint dusting, either, since obviously others have already used the system since the breach. I'll have to maybe set up a keylogger or a camera or something, and watch throughout the night. That is, if the perpetrator happens to be some sort of night-lurker. Taking that the file copying was logged during daytime hours, I'm pretty sure that it wouldn't be someone coming in at night.
Either way, security cameras aimed directly at the server console should do the trick.