Of course there is an upper limit to how provable it is. But that is fairly elaborate malware your describing (because if that is all it did it should be fairly

Of course there is an upper limit to how provable it is. But that is fairly elaborate malware your describing (because if that is all it did it should be fairly apparent - it also has to fake fairly extensive use as well). Mostly it is very easy to see the CP activity (dont forget were not just talking about images on the HDD here but actual activity indicative of behavior). If it were downloaded all together, with no references in, say, web history etc, no thumbnails and nothing in the cache files (which are FULL of rich information) then it would ring alarm bells :) Eventually even the most elaborate malware will make a mistake with activity that is not "normal" - and the investigation is intensive enough to pick this up.