It's exceptionally difficult (read: expensive, time consuming) to do a forensic audit of the sort you're describing, and the adversary has an advantage in this game, because they could potentially engineer their malware to erase itself after the election is over.

The goal of RLAs and other kinds of election auditing procedures is to achieve a property called software independence, such that we can gain confidence in the correct outcomes of an election without requiring any confidence that the software is correct.

In my county we do L&A (logic and accuracy) testing. Both parties are involved everything is signed off and documented. I know this isn't forensic level, but what more would one want? We complete a test deck using ballot markers, test all races in all precincts. Tabulate them and output a print that checks against the test deck produced. All of this is held in archives and reviewable by the public. Machines are zeroed and sealed and will not be touched until election day.

What do you think? 2020 was the cleanest election in the history of the US…..mmmmmk those suitcases they pulled out after they told everyone to leave because voting would resume the next day and proceeded to frivolous scan document after document was completely normal and rational behavior. 81 million people voted for the big guy, he just doesn’t sell much merch.