After an APT incident, IT systems are often installed from scratch or decommissioned entirely. However, if no forensic copy has been made of the IT systems beforehand, trace evidence may be destroyed that would be required to clear up the incident further or even assemble a corresponding court case.