Dual key controls go along way to preventing this kind of thing. So does tamper-proof audit trails based on user roles. This is not the first time an individual has held an enterpise hostage. Is it really a safe option not to assume the possibility of evil administratrors?

I would say more to a point of taking drive images and having a forensics expert looking into it and hopefully mapping his actions to when these issues started. Very strange story though.

A databomb is more likely to be on a watchdog timer, a logical deadman’s switch, or triggered via network access or other predetermined network conditions. If they don’t have access to the involved systems, they’re not likely to find such a bomb, or determine the triggering method.

There’s an issue with the “let ‘em nuke it and restore from backup” option, too. If there is a databomb, how long ago did our dear antagonist place it? How long ago was the latest clean backup? Restoring from a backup set that’s recent enough to have useful data might simply be restoring the logic bomb, too.

The whole thing has been compromised, and needs a top down review by security professionals, along with clean rebuilds and data-only restores.