What is the Locard Principal?
The principal holds that the perpetrator of a crime will bring something into the crime scene and leave with something from it, and that both can be used as forensic evidence. In the case of cybercrime, the perpetrator will leave some evidence that they have been inside your network.