Two kinds of error look like siblings until you try to catch them. One adds something false. The other removes something true. They get talked about as if detection is a single skill — vigilance, applied consistently — but the two failures have almost nothing in common as detection problems, and the asymmetry is worth taking seriously on its own terms.
Start with art authentication. A forged painting is, in a narrow sense, generous to the investigator: it has to compete with the real thing. Pigment chemistry, brushwork, provenance paperwork — the forgery makes a positive claim, and positive claims can be checked against the world. Connoisseurs and labs have spent two centuries getting good at this exact fight, because the fight is winnable. A burned archive offers no such opening. Nothing there is making a claim you can test. You don't disprove ash; you can only notice, if you happen to be looking, that something is missing that you expected to find — and most of the time nobody was looking, because nobody knew to expect it.
The same split shows up in fraud. A fabricated invoice leaves a trail: a vendor who doesn't exist, a bank account that doesn't reconcile, a signature that doesn't match. Forensic accounting is built almost entirely around catching this kind — comparing a claim against everything else the claim has to be consistent with. But a destroyed invoice — a real transaction with its record deleted rather than a fake one inserted — doesn't leave a competing claim to catch. It leaves a gap in a ledger that, absent an external total to reconcile against, just looks like a ledger with one fewer line. The 2001 Arthur Andersen shredding wasn't clever forgery. It was the much older trick of making sure there was nothing left to be clever about.
Security teams talk about this split under different names — the distinction between an attacker who plants false telemetry and one who wipes the logs. A planted false reading, if the system has any redundancy at all, eventually disagrees with a sensor it shouldn't disagree with, and the disagreement is the alarm. A wiped log doesn't disagree with anything. It just isn't there to be checked, and a system has to have been built, in advance, to notice its own gaps — a heartbeat, a sequence number, a hash chain — or the erasure is simply the new, uncontested version of events. Damnatio memoriae worked on the same principle three thousand years before anyone had a word for integrity checking: you don't need to convince anyone of a lie if you can just make sure the true thing was never asked about again.
The general shape: fabrication is a claim, and a claim can lose. It has to survive contact with whatever else is true, and usually it doesn't, because the world has too many other witnesses. Erasure isn't a claim at all — it's the removal of a question's second term, and a missing second term doesn't trigger anything by itself. Catching it requires someone to have already expected the thing that's gone, independent of the record that's supposed to contain it. No amount of scrutinizing the record harder helps, because the record is, by design, internally consistent with its own gap.
Which is the actual test, if you want one: can you write a checksum for an absence? Only if you had a reason, before the fact, to expect the thing that's missing. Otherwise the audit that would catch it is one nobody ever had cause to schedule.