Easier to run tails or other live distros that don't store anything on disk and then run memtest afterwards.

He was googling for "how to delete VMs script" to do the initial attack, I think you overestimate his opsec capability.

He had an opsec capability? I assumed he'd never heard of opsec.