Prove means something differently here. You subpoena records and get every damn email, piece of paper, SMS, meeting transcript, etc. related to the computers. You get invoices from contractors who worked on it. You subpoena the people involved and establish exact timelines of what everyone did, and when.

If these records are incomplete, the judge decides against the police with prejudice.

If the records are complete and there isn’t indications they copied the data and performed analysis entirely off the books, then we say that we’ve proven analysis didn’t happen.