Traceability: a hypothetical scenario

Thank you in advance for taking your time to enlighten me. I’ve done some research myself but still need to get opinions from the community.

A pentester using public wifi connected to Whonix-Tor network on a VM.

The pentester performs vuln scans, finds vuln, and successfully gets access, escalated privelege to that of an admin, and installed a backdoor.

The pentester then deleted event logs.

Has she left any digital footprints? Anything else she could do aside from just deleting the event logs to erase traces? Can she be tracked down, identity exposed somehow? – speaking digitally and electronically only. Let’s suppose she successfully evades all the surveillance and camera in the public area and leaves no physical traces.

Thanks again. I greatly appreciate your time and advice.