[Krutonium]

That's making a LOT of assumptions, like that he saved the seed and so on.

[otterley]

Not just that, but a strong defense would also want to show evidence that the user actually ran those commands, for example, by providing shell history files.