[_nullandnull_]

> isn't it fairly easy to make it nearly impossible to find evidence that any particular piece of information has been compromised?

This is where digital forensics comes in. Just because an attacker has root or admin access doesn't mean all indicators of a compromise can be cleaned up.