Your post causes me to believe even more strongly how important it is to gain copies of all the router logs and config files.
If copies still exist on back-ups somewhere. Regrettably, log servers are not often backed up. They are usually overwritten every 30 days with the news of the moment.
It’s also likely any little app running under a LXC container would be gone as well.
But it’s also unlikely routers were used to alter an application and database. They should start there and look outward.
Look at THOSE connection histories, which they have to back up and preserve for several years, by law.
Agree with your points. I’m certainly not hopeful they’ll find anything on the routers, but they need to look everywhere. Sometimes the smallest detail will steer them down a path they didn’t consider.
Actually, I’m not hopeful they’ll even get the routers to look at. If I’m being honest with myself, I’m not even hopeful this will entire process end in the truth. (But kudos to them for not giving up!)