I'm a SQL admin, yes. The maricopa response told them exactly what to do to 'recover' the data and then they were able to recover it is the first clue that nothing was actually deleted.

Additionally, they're using R Studio and if you've worked with that, the screenshot they gave should look familiar - it's pretty common and just means stuff wasn't copied correctly. It's a horses or zebras situation. Most times, that red X means "bad copy", not "deleted data".

My third reason for this is if he had simply used some kind of data recovery software to recover the data, he would have just said that, and would never have mentioned the RAID configuration.

I think this was just an honest mistake on the side of the auditors that they extrapolated from.