There's nothing to discover if they simply don't collect information that proves your case. My favorite is "we have no evidence that XYZ was stolen" when a com

There's nothing to discover if they simply don't collect information that proves your case. My favorite is "we have no evidence that XYZ was stolen" when a company gets compromised. Why would you want high quality logging at that point? Don't log access to sensitive information and then there's no evidence it was "stolen" (copied or cloned is the correct term). Retention policies are a huge issue too. There have been a lot of cover-ups discovered by people going through old boxes of papers. That's not going to happen in the future because tech companies are providing enterprise grade tooling to continually scrub history via retention policies. No one is going to find a 10 year old "smoking gun" email if you have a 7 year retention policy on all communications.