If Bill says it everyone better damn well listen. This guy was doing meta data analysis in fucking Vietnam on pad and paper and getting it right!
They technically do not need the servers. They need access logs from the network edge.
The first point of intrusion in order to even access any servers on her intranet would have been to breach the network edge meaning the area of her network that was closest to the public Internet.
I should clarify though so I do apologize for not doing so prior. What I meant was that to simply say "someone" hacked her all they would need to have really is logs that show someone unauthorized accessed her network. They do not need her server for that. They need the logs for her network only. Some of that shit can be obtained from an ISP as well.