How would you perform forensic analysis to identify artifacts of persistence or lateral movement on T-Mobile systems?