A company manager stated that the company network was invaded and the invader was able to get sensitive information, like bank account data, passwords, personal info, etc.

I know that I need first stop current and future invasions (unplug the internet cable), then later nuke all data and reinstall all OSes and software in each PC.

But I'm worried about if is it possible track some info about the invader before the reinstall. **What is the basic or common places in the system where can I find logs, traces or tips of the invader and their steps? There are some recommended tool to perform that job?**

*EDIT - Most PCs are running Windows based OSes (mostly WinXP or Seven). All PCs connected to basic network hub-switch and the network is linked to internet via ADSL Router. Probably no logging (unless Windows let some kind of network logging activated as default - it is included in my question)*