. "Nothing is to be removed or altered as to make it impossible to know whose Social Security or credit card numbers, or other high risk personal information might have been taken (e.g., data files, system logs and other data that might be useful in investigating the extent of PNPI stolen during the breach)." . . . .