Use when investigating a system where an attacker may have tried to destroy or falsify evidence — recognising log clearing, timestomping, wiping, and the traces these techniques leave.
