Reverse engineering a hack

Does anyone have the skillset to reverse engineer a hacked site, in order to determine who hacked the site.
The situation is that a wordpress website was hacked via the pluggin gravity forms. We have a backup copy of the site at the time.

Why don't you check the logs and IPs of the person who was trying to access your website?