The BIOS has some flash memory. Various devices have flashable firmware. If the machine is on the network, storage could be remote. Maybe the attacker plugged a

The BIOS has some flash memory. Various devices have flashable firmware. If the machine is on the network, storage could be remote. Maybe the attacker plugged a flash drive into a USB port. Maybe the attacker left a bluetooth-accessible device nearby. Or the attacker could just use the hard drive. Pick a random block. Chances are decent the corruption won't be noticed anytime soon, especially if the block is, say, at the end of the ext4 journal, which was probably clean at shutdown anyway.