Ironically, some attacks on blockchains themselves (like 51% attacks) are actually harder to analyze, because part of the evidence lives in blocks that were deliberately orphined from the blockchain, and the p2p network doesn't have any incentive to share those blocks. I've analyzed such attacks and you actually have to examine the caches and logs of nodes that were running at the time to find evidence.