> they remove any public-facing evidence You screenshot the evidence before letting them know that it exists, and then you take that to the judge. "But we took

> they remove any public-facing evidence You screenshot the evidence before letting them know that it exists, and then you take that to the judge. "But we took down the site" isn't going to stop them from ordering discovery or stop your screenshots from being evidence... It can't be a total fishing expedition, but it doesn't need to be much more (as I understand it, not a lawyer). There's also always the human element, someone on the inside let's you know (and indeed, you might compensate them for that, like the Software Alliance does). There's also the fact that most software isn't exactly... subtle... about what it is in the backend. Error pages and such are often quite distinctive.