They were suspicious when a unix terminal (telltale sign you might have accidentally installed linux) popped up so they did some forensics!

Hey, at least his grep did have the --color switch enabled.