if you see the files zer0 tar

gz on a Linux system while doing an investigation, what can you conclude?