> Do they jump on someone's desktop and start searching for evidence? Do they say "nobody touch nothin' ya hear?" and take over as sysadmin?

Do they use Google Desktop search or the local office's Google search appliance to search for the incriminating evidence?