

If there’s evidence, then it should be producible. A notepad with the imprint of the removed page. A hard drive with the deleted and recovered data. You don’t get to hide behind the term ‘forensic’, saying ‘trust us bro’.
So what kind of forensic evidence? Show it.
Password manager