I would issue an executive order changing the locks on the two buildings. Then I would go in with a forensics team with top secret clearance, and go through every computer and server, glean all of the information needed, and then let only those back in that were absolutely necessary and not partisan.
May take a month, but the country can postpone all trials, or legal matters for 30 days while this is being sorted out. Rosenstein and the Keebler Elf can have a paid holiday.
Just need the Microsoft Exchange Server and the single server that has the pst file of the folks logged on. If you check security logs every aspect of a user is logged for any access, printing, internet, email, etc. If find something else then you move to spending 4-6 hours recovering a zPC.