They don't, they just try their best to reconstruct the attack with whatever "footprints" the perpetrators left, along with any independent logging they might h

They don't, they just try their best to reconstruct the attack with whatever "footprints" the perpetrators left, along with any independent logging they might have in place. It's a little nightmare because it's rare to give absolute certainty.