Everything from deleting specific files--
what if they clear their cache?
What if they clear just some browser history?
What if they clear cache from an application?
If they delete an application, it honestly
depends on how they delete it.
When you delete these apps, sometimes you
can say that you want the data to all be erased.
Do you want only the application to be removed?
Think about Apple where you can decide
to give Apple control that, if you haven't used
an app in a while, it kind of offloads it,
what does that look like?
What if you selectively delete text messages, messages
in general, internet history?
What if you wipe the entire device?
The easiest way for us to detect malicious activity like this
is truly when a user wipes their entire device
and tries to set it up again.
If they're modifying files and just doing selective deletion,
that's actually a little bit more complex.