Here's how they do it, they re-image the server all in the name of an "update", time/date on server is probably incorrect to begin, to break the audit trail. Servers hard drive gets re-imaged or simply swapped and replaced with another hard drive all cleaned up. The backup hard drive is what they shredded, and they'll claim there's no need for the backups anymore.