This is very vague. Please give more details.
What you really want to do is go after the backup tapes (plural) since you mentioned a website I assume they are backing up offsite. Get after them as they will back up the attributes of files (creation, updates, deletions, etc..). Depending on the OS, it may show far, far more such as who had access, extended attributes and depending on the backup type who accessed the files last.
But without more info on “who” the opponent is (i.e., what kind of files and from where), it is hard to answer. For all we know, it was a virtual machine in Amazon’s cloud that has been deleted once and recreated with ACL’s reset across the board.
Thanks for the info. I can’t be specific right now but I can say opponent is non security/ domestic US fed government agency.