This question already has an answer here:
Some background: My org is potentially involved in a legal dispute with a securities brokerage in a under-developed country with mediocre rule of law. The broker also is responsible for co-locating a machine used for trading at the exchange. The machine is owned by our org, but network administered by the broker and hosted at their rack.
Shortly after the incident in question the host blocked our network access to the machine. This is already a potential legal problem for them, as we've paid for hosting through the month. Also any reasonable person would conclude that we want access to our system logs to represent our side in the dispute.
Luckily for us, the relevant logs were already pulled out of the machine to off-site storage. Also in favor is that the machine has 256-bit AES full disk encryption. The disk contains our proprietary binaries (compiled with GDB symbols), and system logs, which are relatively transparent to any sophisticated actor.
Obviously I'd prefer our adversary not to have this information if possible. That would augur for formally petitioning to return our machine to us, before they have time to tamper or extract information. On the other hand the encryption is fairly strong, and the machine is powered off preventing a cold boot attack. Our adversaries capabilities fall well short of state actors or even first world tech orgs. That would augur for giving themselves time to dig themselves into a deeper hole. If they take the extra time to tamper with or destroy the machine, that would be a major point for our org in the dispute.
What's the general opinion of the community here? Do you think there's an obvious answer to this dilemma? Or if not do you see any pros or cons that I'm overlooking?