Conclusion

A lot can be learned from compromised system.

Thorough analysis is difficult, contextual, and time-consuming.

For criminal charges, rely on experts to perform forensic analysis $\rightarrow$ it's not merely an engineering problem!