Would the virus actually delete itself by writing over the data? If not, it would be possible to detect that the suspect had the virus.