She said elsewhere that her personal iMac was running Windows under Bootcamp - so it was a Windows machine for all intents and purposes. She’s switched to Mac OS X on her iMac and gotten a Mac laptop since. Remember, the NSA is complaining that they *can’t* get into Mac OS X and iOS machines...
Given the circumstances, and the year, 2012, I suspect they could have gotten into the iMac and installed something as well as into a Windows PC. They did, after all, have physical access. I can think of about four ways to do it. She could have nailed it down but most users don't take those steps.
I had a hint about it being Windows because of the speed of the file deletions she mentioned. That kind of visual representation is only something you see on a Windows display.