Since even deleted files can be examined it is imperative that you remain highly scrupulous about your dealings with such information. Never, under any circumstances, use the information gleaned from an investigation to your or other's personal advantage. A second computer that could talk to the network would be a welcome, but not necessary, aide. A laptop can be used to store results, notes, and data, but be cautious about who has access to the second system. Ideally it will only be accessible from you.
Discretion is another fine thing to have.
And while speed is of the essence, attempt to stay calm and don't panic. Anything you do will destroy evidence, so simply don't touch it for now, or do as little as possible and don't start looking for damage yet. And while you might get lucky and find all the damage and evidence and perpetrator immediately, don't get your hopes up too much, this is still not an exact science, and almost every case has more than its share of disappointments. If possible, a good first step is to simply disconnect the system from the network. Pull out the network cable, turn off the wireless NIC, whatever.