I was wondering..... If someone in the datacenter can image the VM and mount it some place in their own machine, reset the ssh rsa key, etc. Is it good enough

I was wondering..... If someone in the datacenter can image the VM and mount it some place in their own machine, reset the ssh rsa key, etc. Is it good enough to "produce" the proof of the hack? If so, than no amount of "clean up" can fix the issue, right?