From the new image:
Start-Date: 2018-04-08 20:31:58
Commandline: apt-get install secure-delete
Start-Date: 2018-04-08 20:45:48
Commandline: apt-get install testdisk
Covering their tracks this time, then making sure the secure delete worked using the same program used on this thread to extract deleted files. Hi Baikal!

LOL, that is hilarious! Too bad they forgot to securely delete the 3 earlier versions of the STM firmware on the fat32 partition.
Nice find!