Yes and no, depends on a endless number of factors and specially on which type of forensic audit they will do, to give you an idea, almost all the 'top level' traces can be easily covered / wiped, or like i think they would do in this case, re-create them with fake entries, and really, tampering timestamps / access data on file systems is relatively easy, and i suspect if Dominion / high level entities are behind this, they will have people knowing what is doing behind this, not any script kiddie / wannabe hacker. Now, it can be found or not, depend on how low they will dig, maybe it won't be necessary, but in some high level or special investigations, they can dig down to analyse the state of single electronic components; dump memory / cells straight from onboard chips ( not just for the system memory, but for everything, network controllers, raid controllers, and so on ), surely, if they nuked data with a total erasure / sanitization, or if they just changed out drives or similia, they may not recover back old data, but surely they will be able to get a forensic proof that the devices are not anymore the same ( ex hard drive fingerprint / serial / firmware ) or have been nuked with military / NITS / DOD or whatever standard, and this, in no way is ever done by mistake or with good intensions, specially if the pattern is the same across multiple systems. After that, what can / will be take in consideration or not by the courts, i can't say anything about as i don't really know how in US legal system works or laws are done