Absence of evidence of malware or backdoors on the defendant's computer.[20] Where malware absence is attributed by the defense to a self wiping trojan, evidence of anti-virus/firewall software on the computer helps cast doubt on the defense (such software can result in trojan detection rates of up to 98%[21]) as does evidence of the absence of wiping tools, as "it is practically impossible that there would be no digital traces of [...] the use of wiping tools".[22] Evidence showing that any located malware was not responsible, or was installed after the date/s of the offences.[23] Incriminating activity logs obtained from a network packet capture.[24] In cyber-contraband cases, the absence of evidence of automation - e.g. of close proximity of load times,[6] and contraband time/date stamps showing regularity.