That is what happens when algorithms run.
Let’s not kid ourselves, these algorithms are really programs, running in memory with tons of data points being used.
Look for the cache
This is volatile and can be purged after the fact.
I suggest look for logs. These too are volatile, if they are entirely local. But the logs may have been forwarded (securely or not) to a client/server node. That machine/node may well be the single point of failure for the fraudulent system. Find it.