Deleted is evidence: what attackers cannot erase, in 7 principles

Four kinds of traces, which ones attackers can erase, and seven principles that turn a missing log into a lead.