I have reason to believe that an employee has been either crashing or simply taking the MICROS POS system offline during his shift in order to cover up theft. Mysteriously the MICROS system only seems to "crash" when he is working. Does anyone have any experience with how this can be done, and more importantly, what trail it may leave to prove what happened?