Request trap and tracing from your local telephone company. Consider installing caller identification. Make backups of damaged or altered files. Maintain old backups to show the status of the original. Designate one person to secure potential evidence.
Evidence can consist of tape backups and printouts.
These should be initialed by the person obtaining the evidence. Evidence should be retained in a locked cabinet with access limited to one person. Keep a record of resources used to reestablish the system and locate the perpetrator. Encryption of transmissions. Use of one-time password generators.