A computer is provided with software that looks for certain activities that may be illicit (e.g. processing of a graphic file corresponding to a banknote). If such an activity is detected, tracer data detailing the activity is generated and secretly stored. in the computer. If the computer is later searched or seized, the tracer data can be recovered and employed as evidence of the computer's use, e.g. in counterfeiting.